Administer > Manage Certificates > Using Certificates with the PKCS #12 Repository > Working with Certificates in Application Failover Environments

Working with Certificates in Application Failover Environments

Using Certificates with Application Failover

Note NNMi10.30 introduces a Public Key Cryptography Standards (PKCS) #12 repository to store certificates. The new PKCS #12 file-based certificate management technique is available for use as soon as you install a new instance of NNMi10.30 on a system. Environments upgraded from an older version of NNMi continue to use a JKS repository to store certificates.

In upgraded environments, you can migrate to the PKCS #12 repository by using the steps in Configure an Upgraded NNMi Environment to Use the New Keystore.

If you have upgraded to NNMi10.30 and did not complete the steps in Configure an Upgraded NNMi Environment to Use the New Keystore, skip to Working with Certificates in Application Failover Environments.

When configuring the application failover feature, you must merge the content of the truststore file for both nodes into one nnm-trust.p12 file.

Complete the following steps to configure the application failover feature to use self-signed or CA-signed certificates.

Caution If you are using self-signed certificates with NNMi along with the application failover feature, and do not complete the following steps, NNMi processes will not start correctly on the standby NNMi management server (Server Y in this example).

  1. Change to the following directory on Server Y :

    • Windows:%NnmDataDir%\shared\nnm\certificates
    • Linux: $NnmDataDir/shared/nnm/certificates
  2. Copy the nnm-trust.p12 file from Server Y to some temporary location on Server X. The remaining steps refer to these file locations as <truststore>.
  3. Run the following command on Server X to merge Server Y’s truststore into Server X’s nnm-trust.p12 file.

    Windows:

    nnmcertmerge.ovpl -truststore <truststore> 

    Linux:

    nnmcertmerge.ovpl -truststore <truststore>
  4. Copy the merged nnm-trust.p12 file from server X to server Y, so that both nodes have the merged files. The location of this file is as follows:

    • Windows:%NnmDataDir%\shared\nnm\certificates
    • Linux: $NnmDataDir/shared/nnm/certificates
  5. Run the following command on both Server X and Server Y. Verify that the displayed results from both servers, including the fully-qualified-domain names, match. If they do not match do not continue, rather redo 1 through 1.

    Windows:

    %NnmInstallDir%\bin\nnmkeytool.ovpl -list -keystore %NnmDataDir%\shared\nnm\certificates\nnm-trust.p12
    -storetype PKCS12 -storepass ovpass

    Linux:

    $NnmInstallDir/bin/nnmkeytool.ovpl -list -keystore $NnmDataDir/shared/nnm/certificates/nnm-trust.p12 -storetype PKCS12 -storepass ovpass
  6. Continue configuring the application failover feature at Application Failover.