VASA Provider certificate expiration alarm

Hello Stephan-thevalley,

Here is a link to a KB that maybe of assistance.

https://dell.to/3gSFMWK

The cert for the VASA provider  have always a runtime of 1Y. If you use the DSM Datacollector(formaly know as EnterpriseManager) there is a KB availaible where the cert is located. If you delete or just move it out of the way and reboot the service or better the complete windows OS the certs will be automaticly recreate and you can reuse VASA again.

If you use the virtuall appliance you need the Dell Support because there is a challange responce implementet to get "root" access to the underlaying linux OS. In our case the support was unable to regenerate the certificates and we have to reinstalll the appliance. Because we have a live volume setup and more than one CS system this wasnt fun... but to be true it wasnt a big deal.

I'll check my inbox if i find my support case which contains the URL to the KB.

PS: In our case the cert was already time out and our backup software was unable to restore a VM because we used storage profiles based on VASA information which wasnt available any more because of the out dated cert (maybe provider was also Offline and we are unable to bring it back)!!

Imho dell have forget to implement something in the DSM/Unisphere to regenerate the certs.

Regards,
Joerg

Ok... in my own ticket system i have c&p the content of the KB....

Workaround 1

Un-register the vasa provider.
Delete the following files in the below location: dell_vasa_provider.jks, cacerts.jks, dell_vasa_provider.csr, keystore.jks
DSM Windows - "C:\Program Files\Dell EMC\Storage Manager\msaservice\plugins\vasa "
DSM VA - /em/msaservice/plugins/vasa/
Restart the DSM Server / Virtual Appliance.
After the re-start you should be able to see the files that were deleted are regenerated.
Re-register the vasa provider.

VASA registration should complete and a new certificate should be available.

If for some reason the VASA Certificate still doesn't get renewed or the files that were deleted are not regenerated follow the below workaround.

Workaround 2

Add keytool.exe to the path, Keytool is part of Java installation, it must be available in jdk\bin folder in Java 8 / 11.
Navigate to the location for VASA
DSM Windows - "C:\Program Files\Dell EMC\Storage Manager\msaservice\plugins\vasa "
DSM VA - /em/msaservice/plugins/vasa/
Run the command - keytool -list -v -keystore dell_vasa_provider.jks. There will be a single entry named "vasakey"
Delete this entry - keytool -delete -v -keystore dell_vasa_provider.jks -alias vasakey
Delete the file dell_vasa_provider.csr if it exists.
Restart the DSM
Register the VASA provider again.

We are running an appliance, so I opened a supportcase with Dell.
Solution was easy :

If you're using the DSM-VA then yes.
See page 24 Next Steps After Migration which shows you where to generate a new certificate:
https://dl.dell.com/topicspdf/dsm-2020-ig_en-us.pdf