RSA Product Set: SecurID
RSA Product/Service Type: Authentication Manager
RSA Version/Condition:  8.x

1. ​Login to the primary Authentication Manager's Operations Console.
2. From Maintenance > Backup and Restore > Backup Now to take backup of the database.
3. Certificate Signing Requests (CSR) are left in a pending state reside in a file called /opt/rsa/am/server/security/webserver-inactive.jks.  Before making any change always make a backup so navigate to the /opt/rsa/am/server/security folder and make a copy of the webserver-inactive.jks file.  Open an SSH session to the Authentication Manager primary and login as the rsaadmin user.  Run the following commands to create the backup: 

cd /opt/rsa/am/server
cp webserver-inactive.jks webserver-inactive.jks.BAK

4. To remove the CSR aliases from /opt/rsa/am/server/security/webserver-inactive.jks, the administrator will require the SSL Server Identity Certificate Keystore File Password.  This can be obtained using the command ./rsautil manage-secrets -a list com.rsa.signing.key in the /opt/rsa/am/utils directory.  In this instance, the SSL Server Identity Certificate Keystore File Password is g972SpITERSGMtYCZWevKd4UTVuZUw.  Yours will be different

rsaadmin@app81p:/opt/rsa/am/utils> ./rsautil manage-secrets -a list com.rsa.signing.key
Please enter OC Administrator username: <enter the name of the Operations Console administrative user>
Please enter OC Administrator password: <enter the password the Operations Console administrative user>
Secrets stored in ./etc/systemfields.properties.
Command API Client User ID ............................: CmdClient_9uwbaoze
Command API Client User Password ......................: N04vujpJYzkePDn0vf0zjnu2NmEJ1f
SSL Server Identity Certificate Private Key Password ..: jkN1075giQ9IIFD8Pg6uVq4BGFB9yU
SSL Server Identity Certificate Keystore File Password : g972SpITERSGMtYCZWevKd4UTVuZUw
Root Certificate Private Key Password .................: rSl0jKaSPUFww2fb0KVfJdbUIFwQK3
Root Certificate Keystore File Password ...............: Rg10rVYLQW8fNHEdMxbgucWlMQ1mAX

The "listkeys" action displays the key names to use when setting the values.
rsaadmin@app81p:/opt/rsa/am/utils>

5. List the contents of the webserver-inactive.jks file using the keytool utility at the command line to confirm the alias you want to delete actually exists.  For example:

rsaadmin@app81p:/opt/rsa/am> /opt/rsa/am/appserver/jdk/jre/bin/keytool -list -keystore /opt/rsa/am/server/security/webserver-inactive.jks
Enter keystore password: <enter the SSL Server Identity Certificate Keystore File Password capture in step 4>

Keystore type: JKS
Keystore provider: SUN

Your keystore contains 3 entries

 app81poc, Mar 27, 2014, PrivateKeyEntry,

Certificate fingerprint (MD5): 3E:75:75:8F:82:34:B6:64:BC:6E:F1:FF:35:F8:AA:3B

rsa am internal ca, Dec 2, 2013, trustedCertEntry,

Certificate fingerprint (MD5): 92:45:C9:B6:09:25:3E:4A:53:2F:6B:49:EA:E3:BF:17

rsa am default server cert, Dec 2, 2013, PrivateKeyEntry,

Certificate fingerprint (MD5): DD:C7:65:A8:74:36:EE:24:47:36:C4:8F:39:48:EB:89

rsaadmin@app81p:/opt/rsa/am>

6. To delete the unwanted alias (in the example app81oc), an administrator can use the keytool utility at the command line, run the following command:

rsaadmin@app81p:/opt/rsa/am> /opt/rsa/am/appserver/jdk/jre/bin/keytool -delete -alias app81poc -keystore /opt/rsa/am/server/security/webserver-inactive.jks
Enter keystore password: <enter the SSL Server Identity Certificate Keystore File Password capture in step 5>

7. Check the pending entry has been removed from the RSA Operations Console under Deployment Configuration > Certificates > Console Certificate Management.