RSA NetWitness Stale Certificate Probe Check

Issue

Pre Upgrade Check tool detects the presence of stale certificate entries in Mongo DB with the error “ Stale certificate Ids:” with a list of stale certificate IDs.

NOTE: The presence of stale certificates won’t cause any issues to the environment, but we can see some false positive certificate expiry warnings in the UI popup at some point. Hence, cleaning the stale certificate entries from the mongo is recommended.

Cause

These stale certificates are due to decommissioned host certificates in the Mongo database.

Resolution

Run the below commands on admin-server:
1. To backup certificate entries in mongo:

mongoexport --ssl --sslAllowInvalidHostnames -u deploy_admin -p --authenticationDatabase admin --db security-server --collection certificate --out certificate.json

Note: Please replace with the correct password.

2.   Run orchestration-cli-client -l | grep and orchestration-cli-client -s | grep to confirm if the certificate is part of the current environment.
3.   Login to mongo using mongo admin -u deploy_admin -p
4.   Once you are connected to mongo, run command: use security-server
5.   Check the existence of the certificate - db.certificate.find({"_id" : "< CERTIFICATE_ID >"})
6.   Remove the certificate from mongo using db.certificate.remove({"_id" : "< CERTIFICATE_ID >"})

Product Details

RSA Product Set: NetWitness Platform XDR
RSA Product/Service Type: Security-Server
RSA Version/Condition: 12.3 and above

Approval Reviewer Queue

Technical approval queue