Authentication Manager 8.x Virtual Host CSR Remains Pending or Inactive in Operations Console
Originally Published: 2015-06-25
Article Number
Applies To
RSA Product/Service Type: Authentication Manager
RSA Version/Condition: 8.x
Issue
After creating a virtual host Certificate Signing Request (CSR) in the Authentication Manager Operations Console, the CSR cannot be removed through the UI and continues to appear with a status of Pending or Inactive.
Observable symptoms:
- One or more virtual host CSRs are listed under Deployment Configuration > Certificates > Virtual Host Certificate Management with a status of Pending or Inactive
- The CSR persists even after the certificate request is no longer needed or was created by mistake
- There is no delete or remove option available in the Operations Console UI for these entries
Cause
The Authentication Manager Operations Console does not provide a UI option to delete virtual host CSRs that are in a Pending or Inactive state.
Virtual host CSR entries are stored as aliases inside the
vh-inactive.jks Java keystore file on the primary Authentication Manager server. Once a CSR is created and left incomplete — either because the certificate request was abandoned, created by mistake, or the signing process was never finished — the entry remains in the keystore with no way to remove it from the UI.This commonly happens when an administrator creates a virtual host CSR but does not proceed with importing a signed certificate, leaving the request in a permanent Pending or Inactive state in the Operations Console.
Resolution
Step 1: Connect to the primary Authentication Manager server via SSH as
rsaadmin. Enter the operating system password when prompted.Step 2: Navigate to the
utils directory and retrieve the SSL Server Identity Certificate Keystore File Password using the manage-secrets utility:cd /opt/rsa/am/utils
./rsautil manage-secrets -a list com.rsa.signing.keyEnter the Operations Console administrator credentials when prompted
Expected output:
Secrets stored in ./etc/systemfields.properties.
Command API Client User ID ............................: <generated-value>
Command API Client User Password ......................: <generated-value>
SSL Server Identity Certificate Private Key Password ..: <generated-value>
SSL Server Identity Certificate Keystore File Password : <keystore-file-password>
Root Certificate Private Key Password .................: <generated-value>
Root Certificate Keystore File Password ...............: <generated-value>ℹ️ NOTE — Note down the value shown for SSL Server Identity Certificate Keystore File Password — it is required in the steps below. The values shown are unique to your environment and will differ from any example.
Step 3: Navigate to the
security directory and back up the vh-inactive.jks file before making any changes:cd /opt/rsa/am/server/security
cp vh-inactive.jks vh-inactive.jks.BAK⚠️ CAUTION — Always back up the keystore file before making changes. If the delete operation produces unexpected results, the
.BAK file can be used to restore the original state.Step 4: Confirm the backup was created successfully:
ls -l vh-inactive.jks*Expected output:
-rw------- 1 rsaadmin rsaadmin 7588 May 4 13:54 vh-inactive.jks
-rw------- 1 rsaadmin rsaadmin 7588 Jun 23 10:13 vh-inactive.jks.BAK
Step 5: List the contents of the
vh-inactive.jks keystore to identify the alias you want to delete:
/opt/rsa/am/appserver/jdk/jre/bin/keytool -list -keystore /opt/rsa/am/server/security/vh-inactive.jks
Enter the SSL Server Identity Certificate Keystore File Password retrieved in Step 2 when prompted.
Expected output:
eystore type: JKS
Keystore provider: SUN
Your keystore contains 4 entries
webtier, May 4, 2015, PrivateKeyEntry,
Certificate fingerprint (MD5): BA:9F:FD:91:DA:22:E3:35:75:A7:9B:C0:62:E7:04:52
rsa-am-ca, Apr 28, 2015, trustedCertEntry,
Certificate fingerprint (MD5): 70:01:3C:ED:74:27:9C:BF:CE:FE:48:19:8C:2F:91:86
virtualhost-id-key, Apr 28, 2015, PrivateKeyEntry,
Certificate fingerprint (MD5): ED:D4:64:57:30:5D:60:1F:6F:5D:40:56:46:32:F3:77
a3ce4d08120510ac1f349ff8664cdfa0-signing-ca, May 4, 2015, trustedCertEntry,
Certificate fingerprint (MD5): 8C:CA:DC:0B:22:CE:F5:BE:72:AC:41:1A:11:A8:D8:12ℹ️ NOTE — In this example, the alias
webtier is the pending CSR entry. The other three entries (rsa-am-ca, virtualhost-id-key, and a3ce4d08120510ac1f349ff8664cdfa0-signing-ca) are the default entries and must not be deleted. Your pending alias name will match the virtual host name used when the CSR was created.Step 6: Delete the unwanted alias (replace
webtier with the alias name identified in Step 5):
/opt/rsa/am/appserver/jdk/jre/bin/keytool -delete -alias webtier -keystore /opt/rsa/am/server/security/vh-inactive.jksEnter the SSL Server Identity Certificate Keystore File Password when prompted.
⚠️ CAUTION — Only delete the alias that corresponds to the unwanted CSR. Do not delete the default entries (
rsa-am-ca, virtualhost-id-key, or the signing CA alias).Step 7: Confirm the alias has been removed by listing the keystore contents again:
/opt/rsa/am/appserver/jdk/jre/bin/keytool -list -keystore /opt/rsa/am/server/security/vh-inactive.jksExpected output (3 entries remaining — the pending alias is gone):
Keystore type: JKS
Keystore provider: SUN
Your keystore contains 3 entries
virtualhost-id-key, Apr 28, 2015, PrivateKeyEntry,
Certificate fingerprint (MD5): ED:D4:64:57:30:5D:60:1F:6F:5D:40:56:46:32:F3:77
rsa-am-ca, Apr 28, 2015, trustedCertEntry,
Certificate fingerprint (MD5): 70:01:3C:ED:74:27:9C:BF:CE:FE:48:19:8C:2F:91:86
a3ce4d08120510ac1f349ff8664cdfa0-signing-ca, May 4, 2015, trustedCertEntry,
Certificate fingerprint (MD5): 8C:CA:DC:0B:22:CE:F5:BE:72:AC:41:1A:11:A8:D8:12Step 8 — Verify: Log in to the primary Authentication Manager Operations Console and navigate to Deployment Configuration > Certificates > Virtual Host Certificate Management. Confirm the Pending or Inactive CSR entry is no longer listed.
✅ If the CSR entry no longer appears, the issue has been resolved.
Notes
