Replacing certificates in the key database file

You can replace certificates in the key database file if you use older certificates that have shorter keys. Certificates have 2048 keys, but some older certificates have fewer keys, which makes them less secure.

Procedure

To replace certificates in the key database, complete the following instructions:

For self-signed certificates, complete the following steps:
1. Stop the Tivoli® Storage Manager server and the storage agent.
2. Delete the certificates in the key database by issuing the following command:
  Tip: Each command is entered on one line, but is displayed here on multiple lines to make it easier to read.
```
gsk8capicmd -cert -delete -file cert.kdb 
-stashed -label "TSM Server SelfSigned Key"
gsk8capicmd -cert -delete -file cert.kdb 
-stashed -label "TSM Server SelfSigned SHA Key" 
```
3. Delete the cert.kdb file for the server and the storage agent.
4. Delete the cert256.arm and cert.arm files for the server and the storage agent by changing to the server instance and issuing the following command:
```
rm cert.arm cert256.arm
```
```
del cert.arm cert256.arm
```
5. Issue the following command on the storage agent:
```
run dsmsta setstorageserver SSL
```
6. Restart the server. When the server restarts, the server creates a key database and a new password, if there are none available. Old key databases and passwords are invalid.
7. Import the cert256.arm file for the client.
8. Delete the existing certificates for the storage agent and the server.
9. Import the new certificates for the server and the storage agent.
For third-party certificates, complete the following steps:
1. Delete the existing certificates for the storage agent and the server.
2. Import the new certificates for the server and the storage agent.