IBM Support

IBM Security Guardium - How to check for GIM certificates expiration on all managed units

How To


Summary

Default Self signed Guardium GIM SSL certificates are due to expire in May of 2024.
This technote describes how to check if action is required to update certificates on any appliances in a central manager (CM) environment

Objective

Determine if GIM certificate update is required on any appliance in a CM environment.
For description of the GIM certificate expiry issue and how to resolve, see:

Steps

Action is required to update GIM certificates on appliances where:
  • GIM Clients are connected
  • Default self signed GIM certificate, expiring May 2024 is present
If the environment contains known GIM server appliances and GIM clients are connected only to those appliances, then action is required only on those appliances.
However, if its not certain which appliances GIM clients are connected to, ad-hoc patches documented in this technote can be used to check what appliances need action.
Steps to check one appliance directly
  1. In cli run - show certificate summary
  2. Check the lines with Alias Name gim 
  3. If the Valid To date is May/26/2024 or May/27/2024 then the problem is present and action is required
    • The date might be different depending on the time zone of the appliance
    • Example line with a problem:

      • Alias Name          Valid From   Valid To     Subject                                                 File Name
        ------------------  -----------  -----------  ------------------------------------------------------  ----------------------------
        gim                 May/29/2014  May/26/2024 xxxx CN=GIM, OU=xxx, O="xxx", L=xxx, ST=xxx, C=xxx       .keystore

Steps to check all appliances with ad-hoc patches
  1. On the CM only, install the correct ad-hoc patch for your CM version
  2. After patch install completed, collect the results file 
    • From the CM fileserver, opt-ibm-guardium-logs, download results csv file called - enterprise_gim_cert_results_<date>_<time>.csv
    • A new csv file is created for each time the patch is installed, collect the latest one based on date and time
       
  3. Review and understand the results file
    • Example output:
      • image-20240206105230-2
    • Understanding the results:
      • The patch checks the CM and all active MUs
      • If "GIM clients connected" and "Old GIM certificate" column values are both yes - The checks succeeded and "Action required" is yes
      • If "GIM clients connected" or "Old GIM certificate" column values are no - The checks succeeded and "Action required" is no
        • No action is needed on this appliance, because there are no GIM clients or the certificates are already updated
      • If "GIM clients connected" and "Old GIM certificate" column values are both "Not found" - The patch was not able to check this appliance
        • The root passkey might not be set or the appliance is down
        • Action is required to check the appliance directly, or set the root passkey and re-install the patch
      • If "GIM clients connected" or "Old GIM certificate" column values have an error - The patch was able to check the appliance but the commands did not work as expected
        • Action is required to check the appliance directly
        • If a large number of appliance have this problem, see troubleshooting steps section
Troubleshooting ad-hoc patches
  • The patches can be reinstalled multiple times
    • If appliances are down or root passkeys not set, re-install after resolving the problem and check the newest results csv
  • If any unexpected result is found, contact Guardium support and provide:
    • Results csv file
    • Log file from CM fileserver opt-ibm-guardium-logs, download file called - gim_cert_expiry_check_<date>_<time>.log, with date and time matching the csv file 
    • Patch and system_db issues must gathers from CM
    • From one of the MUs with a problem:
      • Output of cli - show certificate summary
      • Output of cli - support show passkey root
      • Patch and system_db issues must gathers

Additional Information

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSMPHH","label":"IBM Security Guardium"},"ARM Category":[{"code":"a8m0z000000Gp0TAAS","label":"GIM"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
19 February 2024

UID

ibm17115254

Page Feedback