RSA Product Set: SecurID
RSA Product/Service Type: Authentication Manager
RSA Version/Condition: 8.x
Component: Operations Console, Certificate Signing Requests (CSR)

Use this article if one or more Certificate Signing Requests (CSRs) remain in a pending state in the RSA Authentication Manager Operations Console and need to be removed. This can occur in the following situations:

• A CSR was generated but never submitted to a Certificate Authority (CA)
• A CSR was submitted to a CA but the resulting certificate was never imported
• A CSR is no longer needed and is cluttering the Certificate Management interface

CAUTION: Perform Steps 1–3 before making any changes to the keystore file. Failure to back up the database and keystore file may result in data loss.

1. Log in to the primary Authentication Manager Operations Console and take a database backup: Navigate to Maintenance > Backup and Restore > Backup Now and follow the on-screen instructions to complete the backup.
   
   
2. Open an SSH session to the primary Authentication Manager server and log in using the operating system credentials.
   NOTE: If SSH is not enabled on the Authentication Manager instance, enable it before proceeding. For instructions, see Enable Secure Shell on the Appliance
   
   
3. Back up the webserver-inactive.jks file before making any changes:
   

   cd /opt/rsa/am/server/security
   cp webserver-inactive.jks webserver-inactive.jks.BAK

    

4. Retrieve the SSL Server Identity Certificate Keystore File Password by running the following command from the /opt/rsa/am/utils directory:
   

   cd /opt/rsa/am/utils
   ./rsautil manage-secrets -a list com.rsa.signing.key

   When prompted, enter the Operations Console administrator username and password. The output will resemble the following:|
   

   Please enter OC Administrator username: <oc-admin-username>
   Please enter OC Administrator password: <oc-admin-password>
   Secrets stored in ./etc/systemfields.properties.
   Command API Client User ID ............................: <value>
   Command API Client User Password ......................: <value>
   SSL Server Identity Certificate Private Key Password ..: <value>
   SSL Server Identity Certificate Keystore File Password : <keystore-password>
   Root Certificate Private Key Password .................: <value>
   Root Certificate Keystore File Password ...............: <value>

   NOTE: Note down the value shown for SSL Server Identity Certificate Keystore File Password. You will need it in the following steps.
   
   

5. List the contents of the webserver-inactive.jks file to identify the pending CSR alias:
   

   cd /opt/rsa/am/server
   /opt/rsa/am/appserver/jdk/jre/bin/keytool -list -keystore /opt/rsa/am/server/security/webserver-inactive.jks

   When prompted, enter the SSL Server Identity Certificate Keystore File Password retrieved in Step 4. The output will resemble the following:

   Enter keystore password: <keystore-password>
   Keystore type: JKS
   Keystore provider: SUN
   Your keystore contains 3 entries
   
   <pending-alias>, <date>, PrivateKeyEntry,
   Certificate fingerprint (MD5): <fingerprint>
   rsa am internal ca, <date>, trustedCertEntry,
   Certificate fingerprint (MD5): <fingerprint>
   rsa am default server cert, <date>, PrivateKeyEntry,
   Certificate fingerprint (MD5): <fingerprint>

   NOTE: The pending CSR alias will be a custom entry. The entries rsa am internal ca and rsa am default server cert are the default entries and should not be deleted.
   
   

   Delete the pending CSR alias using the keytool utility. Replace <pending-alias> with the alias name identified in Step 5:
   

   /opt/rsa/am/appserver/jdk/jre/bin/keytool -delete -alias <pending-alias> -keystore /opt/rsa/am/server/security/webserver-inactive.jks

   When prompted, enter the SSL Server Identity Certificate Keystore File Password retrieved in Step 4.
   
   

6. Verify: Log in to the Operations Console and navigate to Deployment Configuration > Certificates > Console Certificate Management to confirm the pending CSR entry has been removed. 

NOTE: Only delete CSR aliases that you are certain are no longer needed. Deleting an active or required certificate entry may disrupt secure communication between Authentication Manager and its management interfaces.

NOTE: The default entries rsa am internal ca and rsa am default server cert must never be deleted from the keystore. Removing these entries will break Authentication Manager functionality.

NOTE: If you need to restore the webserver-inactive.jks backup created in Step 3, navigate to /opt/rsa/am/server/security and run:

cp webserver-inactive.jks.BAK webserver-inactive.jks

Restart Authentication Manager services after restoring the file.