Content

1. In cli run - show certificate summary
2. Check the lines with Alias Name gim
   • There are two certificates with Alias Name gim. Only one of them expires in May 2024.

1. If the Valid To date of one of the certificates is May/26/2024 or May/27/2024 then the problem is present and action is required
   • The date might be different depending on the time zone of the appliance
   • Example line with a problem:

     • Alias Name          Valid From   Valid To     Subject                                                 File Name
       ------------------  -----------  -----------  ------------------------------------------------------  ----------------------------
       gim                 May/29/2014  May/26/2024 xxxx CN=GIM, OU=xxx, O="xxx", L=xxx, ST=xxx, C=xxx       .keystore

• IBM Security Guardium - How to check for GIM certificates expiration on all managed units

• All v10.6
• All v11.3
• All v11.4, except case when first GIM client installed after appliance was on p475
• All v11.5, except case when first GIM client installed after appliance was on p530
• v12 appliances upgraded from v11.5, where v12.0p10 not installed
  • v12.0p10 resolves the issue

1. If not using recommended generic ad-hocs, install the prerequisite bundle listed in the table for your appliance version
   • For bundles p530, p475 and higher, GIM certificates are updated to SHA256. These bundles require additional actions to manage the transition. Follow steps in - Updating Guardium Data Protection GIM clients with SHA256 certificates
   • If appliance is below p530 or p475, use the generic ad-hocs to avoid extra actions for SHA256 transition
2. Install the patch listed in the table, for your appliance version
3. After Patch installation, give couple hours for automatic distribution of renewing GIM certificates on agent side to execute. Status can be checked through the report “GIM Certificate Deployment Status”
4. If system configuration backup is scheduled on the appliance, run the backup after the certificates are updated
   • If backup is required for disaster recovery, use system configuration backups taken after the GIM certificates are updated
5. If new GIM client is installed with old certificates and pointed to the environment where certificates are already updated, to renew certificate for this  new GIM client
   • In GIM GUI enable parameter - 'gim_auto_certificate_distribution' to 1
   • In cli run - store certificate gim client auto-generate  - select the client that you need to renew certificate for.

1. Install the correct appliance patch as outlined in the remediation section listed above for your appliance version.
2. Upgrade GIM bundle (using transitional bundle GIM if not being used prior, otherwise use standard bundle GIM) with the updated certificate directly on database server. In case of fresh installation, use regular bundle GIM. The versions for the GIM bundles are :

After installing patches listed above to remediate GIM client and server certificate expiration,  the certificate was not renewed on GIM client side and as a result the GIM clients are unable to communicate with GIM server. Some of those GIM clients will show in output of Cli command “show certificate gim client" : "STATUS: PENDING - Certificate is waiting to be distributed."

Recovery steps:

1. For v11.4 or v11.5 Guardium versions, apply the below adhoc patches 11.0p1284 ; for v12.0, apply adhoc patch 12.0p1109. And, then monitor GIM process monitor via GIM console and GIM certificate deployment report closely. 

   Guardium version	Patch zip file	Patch md5sum
   11.0	SqlGuard-11.0p1284.tgz.enc_.sig__0.zip	9b0d483f2f80e9a5d88deda19404f189
   12.0	SqlGuard-12.0p1109.tgz.enc_.sig__0.zip	56e9105d23f638ca049d112694ec083e

   Download the zip file from this technote and unzip to get the patch, or contact Guardium support to provide
2. Above patch will disable certificate validation between GIM server and clients for communication via port 8446.  You should observe GIM clients showing up in GIM process monitor gradually. Also, in GIM certificate deployment report,  the deployment status moves from PENDING to PROCESSING to ACTIVE gradually for GIM clients. 
3. If there still PENDING GIM clients remaining in GIM console.  Assess if these GIM clients are removed or repurposed. If 'pending' GIM clients no longer exist and not needed,  via GIM console, 'reset connection' via GIM 'Setup by client' feature to remove them from DB.  If 'pending' is due to machine/GIM client down, fix them first.  If they are still stuck in pending,  use CLI 'store certificate gim client auto-generate' to fix them individually or via range. Finally, if CLI 'auto-generate' is not helpful, upgrade GIM clients on DB server (for Unix OS using the bundle GIM *.gim.sh installer) to the latest GIM installers uploaded to Fix Central:    For Unix OS: v11.4_r117207, v11.5_r117180 , v12.0_r117209     For Windows OS: v11.4.0.413, v11.5.0.338, v12.0.0.183
4. After confirming all GIM clients are with green status in "GIM Processes Monitor" , in v11 install adhoc patch 11.0p1285; in v12.0 install adhoc patch 12.0p1110 to restore original parameter value in server.xml, which  enables GIM server and client communication via certificate.

   Guardium version	Patch zip file	Patch md5sum
   11.0	SqlGuard-11.0p1285.tgz.enc_.sig__0.zip	2c036ea2173a1565cbbe49690d9c6a2d
   12.0	SqlGuard-12.0p1110.tgz.enc_.sig__0.zip	44d4597f522577c8b139eb16a8f992bc

   Download the zip file from this technote and unzip to get the patch, or contact Guardium support to provide