I recently resurrected an EMC Data Domain as I have a new, potential use for it. It was offline for a while and the thought was to power it on, check out its health, the firmware version, and a few other things. As luck would have it though, when attempting to log in using the web UI, the page wouldn’t load. After poking at it for a few and some additional Googling, I found that the self-signed certificate expired resulting in the web services not starting. In this post, I’ll share the steps that were taken to get the UI back up and running.
Overview of Steps
- Verify the active hostname and inspect the current HTTPS certificate state.
- Regenerate the local Certificate Authority (CA) and self-signed certificate.
- Reset the local mutual trust for the hostname.
- Bounce the Web UI services (
https/http) to apply changes.
Step-by-Step Procedure
1. Verify Hostname and Certificate Status
First, connect to the device via SSH, grab the FQDN of the Data Domain, and confirm whether an imported host certificate exists for the HTTPS application:
admin@datadomain# hostname
The Hostname is: datadomain.example.local
admin@datadomain# adminaccess certificate show imported-host application https
**** There is no imported host certificate for application(s): https.If no imported host certificate exists (or if it is invalid), proceed with regenerating the self-signed certificate.
2. Regenerate Local CA and Self-Signed Certificates
Generate a fresh self-signed certificate and force a regeneration of the local Certificate Authority:
admin@datadomain# adminaccess certificate generate self-signed-cert regenerate-ca
** WARNING: Regenerating local CA certificate will invalidate existing trust with external system(s).
Secure communication to trusted host(s) will be broken until mutual trust is reestablished.
Do you want to proceed? (yes|no) [no]: yes
New certificates have been generated.3. Reset Local Mutual Trust
Next, tear down the stale mutual trust entry associated with the local hostname and re-add it using the newly generated CA fingerprint.
Delete the old mutual trust entry:
admin@datadomain# adminaccess trust del host datadomain.example.local type mutual
Deleting trust with ' datadomain.example.local ' may cause some management functions to stop working.
Are you sure? (yes|no) [no]: yes
ok, proceeding.Re-add mutual trust for the local hostname:
admin@datadomain# adminaccess trust add host datadomain.example.local type mutual
The SHA1 fingerprint for the remote host's CA certificate is
XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX
Do you want to trust this certificate? Are you sure? (yes|no) [no]: yes
ok, proceeding.
For adding the mutual trust with " datadomain.example.local ", enter " datadomain.example.local " admin password:
Mutual Trust with host " datadomain.example.local " has been added.4. Restart Web UI Services
Finally, cycle the HTTPS and HTTP admin services to bind the new SSL certificates:
admin@datadomain# adminaccess disable https
HTTPS Access: disabled
admin@datadomain# adminaccess enable https
HTTPS Access: enabled
admin@datadomain# adminaccess disable http
HTTP Access: disabled
admin@datadomain# adminaccess enable http
HTTP Access: enabledVerification
Open a browser and navigate to https://datadomain.example.local. Accept the self-signed certificate warning, and the Data Domain System Manager login screen should load normally.