000032022 - Backup restored from different RSA Authentication Manager 8.x deployment breaks Agent API 8.5 agents including RSA SecurID Access

2015-11-17 19:34:50,954, [[ACTIVE] ExecuteThread: '0' for queue: 'weblogic.kernel.Default (self-tuning)'],
(AgentConfigPolicyAdministrationImpl.java:17),
trace.com.rsa.authmgr.internal.admin.configmgt.impl.AgentConfigPolicyAdministrationImpl,
DEBUG, rsa8.<domain>.com.local,,,,
Processing request for agent configuration.

Before importing and restoring a database from another RSA Authentication Manager 8.x server, note the following system changes:

1. Change the internal database super admin account and password to the RSA Authentication Manager 8.x instance from which the backup came.
2. Change the Operations Console administrator account and password to the one from which the RSA Authentication Manager 8.x instance the backup came.
3. Add an inactive console certificate from the the RSA Authentication Manager 8.x instance from which the backup came, including the root CA. In this way, the consoles will work, but the accounts have changed.
4. Change the agent cert in Security Console:
   
   1.  Go to Setup > System Settings.
   2. Under Authentication Settings, click the Agents link.
   3. Click the here link to configure agents using IPV6.
   4. Change the agent certs to be the same as the instance from which the back up came.
5. Any existing API 8.5 agents (including RSA SecurID Access) that existed before the database restore will no longer work because they are encrypting with the original RSA Authentication Agent certs, so the agent will not be able to build the SSL connection and therefore, will not send any authentication requests
6. Any sdconf.rec generated from now on will contain the root CA from the RSA Authentication Manager 8.x instance from which the backup came.

1. Generate and download a new sdconf.rec (Access > Authentication Agents > Generate Configuration File) and replace the existing sdconf.rec on each agent.
2. Go to Setup > System Settings. Under Authentication Settings, click the Agents link.
3. Click the here link to configure agents using IPV6. 
4. Review the cert imported, make sure if it's correct, or change it otherwise.
5. Click Save.

• The one originally created at deployment, or
• The one in the restored backup.

This means that restoring an RSA Authentication Manager 8.x backup from another system breaks any TCP 5500 port Agent API 8.5 type traffic.

To fix this situation, you must extract the root CA cert from the original RSA Authentication Manager 8.x backup and import it into the new RSA Authentication Manager 8.x server using the steps below:

1. Through the Security Console (Setup > System > Agents).
2. Under Authentication Settings, click the Agents link then click the here link to configure agents using IPV6.

3. Scroll down to bottom of page.
4. Under Existing Certificate Details, you can see the current root CA information from the original deployment of this RSA Authentication Manager server:

5. You can import the certificate of the new primary server by clicking Choose File to import the original root CA. The UI states "Use for migrating the agents to the new deployment." This is vaguely documented on page 463 of the RSA Authentication Manager 8.1 SP1 Administrator's Guide, under "Configure an IPv4/IPv6 Agent," where it says:

(Optional) In the Import Certificate of the New Primary Server field, click Browse to locate and import a new root certificate.

Note: You are required to import a new root certificate only if you are migrating agents to a new deployment. This feature supports migrations from RSA Authentication Manager 8.0 to future versions of Authentication Manager.

6. To obtain a root CA from the original RSA Authentication Manager 8.x server, use openssl with the -showcerts option from within SSH:

7. Running the openssl command shows the server certificate chain in red and the root CA certificate chain in blue:

8. Copy and paste the cert into a text editor such as Notepad and save as a .cer file.
9. Make sure the file includes the -----BEGIN CERTIFICATE----- as the first line at the top of the file and -----END CERTIFICATE----- at the bottom, as the last line, like this:
   
   1. Edit the sdconf.rec with a text editor, such as Notepad++.
   2. Scroll down past the encrypted characters to the bottom.
   3. Enable word wrap.
   4. Look for the delimiter with X509 in it, as shown:

5. In between the start <bootstrap:X509Certificate>and stop </bootstrap:X509Certificate> is the certificate. Copy all of the text to a buffer. For example,

6. Paste the text to a text editor.
7. Add -----BEGIN CERTIFICATE----- to the top line of the file, ensuring that it is the only text on the line.
8. Add -----END CERTIFICATE----- at the bottom, as the last line, ensuring that is the only text on the line.
9. When done, the file should look as what is shown here:

10. Save the file with an extension of .cer.

9. Open the file with Microsoft Crypto Shell Extensions to read this cert info or optionally, paste into a certificate tool web site.