Troubleshooting Hub Encryption Wallet Issues

This section covers various challenges you may encounter with the hub encryption wallet and provides workarounds to resolve them.

Location Connection Failure After Force Disabling the Encryption Wallet

Issue

After force disabling the encryption wallet using the command dsswalletconfig -fd, error messages about redacted values may be encountered.

Cause

When force disabling a wallet that is in use, all encrypted passwords and keys will be redacted automatically.

Resolution

To resolve this problem, update the redacted location passwords. Also, for locations configured with DSS Agent, all keys and certificates must be regenerated and then the corresponding repository properties must be updated with new values.

1. If the location has agent connection configured, update the keys and certificates, else skip to step 2,

   Expand to see the instructions

   1. Create a new SSL certificate and key using the command dsssslgen (this must be executed on the machine where the DSS Hub System is installed):

      dsssslgen <em>basename</em> "<em>Subject</em>"
      

      This command will generate a Public Certificate (basename.pub_cert) and a Private Key (basename.priv_key) files. The command output will also display the Private Key Password, which is required in the next step.

   2. Update the following repository properties - Agent_Client_Public_Certificate, Agent_Client_Private_Key, and Agent_Client_Private_Key_Password using the command dssreposconfig:

      dssreposconfig Agent_Client_Public_Certificate=@<em>basename</em>.pub_cert Agent_Client_Private_Key=@<em>basename</em>.priv_key Agent_Client_Private_Key_Password=<em>Private_Key_Password</em>
      

   3. If access to the agent is limited to certain hub system(s), the client public certificate (Agent_Client_Public_Certificate) of the hub system must be regenerated and updated in the agent property Only_From_Client_Public_Certificates. This can be done either from CLI or UI:

      {% tabs %}

      {% tab label="CLI" %}

      1. Create a public certificate file of the hub system; execute the command dssreposconfig on the hub machine that needs to be added to the allowed list:

         Linux:

         dssreposconfig 'Agent_Client_Public_Certificate>@<em>file_name</em>.pub_cert'
         

         Windows:

         dssreposconfig "Agent_Client_Public_Certificate>@<em>file_name</em>.pub_cert"
         

      2. Copy the public certificate file (file_name.pub_cert) to the agent machine.

      3. Add the public certificate file of the hub system to the allowed list; execute the command dssagentconfig on the agent machine:

         Direct CLI:

         dssagentconfig Only_From_Client_Public_Certificates.<em>identifier</em>=@<em>file_name</em>.pub_cert
         

         Remote CLI:

         dssagentconfig -R<em>url</em> -h<em>hub</em> -r<em>agent_host</em>:<em>port</em> -L<em>agent_username</em>/<em>password</em> Only_From_Client_Public_Certificates.<em>identifier</em>=@<em>file_name</em>.pub_cert
         

identifier may be replaced with the actual name of the hub (e.g. myhub1) or any name/text to easily identify the allowed hub.