RSA Product Set: SecurID
RSA Product/Service Type: Authentication Manager
RSA Version/Condition: 8.1 and later
 

RSA Authentication Manager (AM) 8.2 generates internal SHA-256 certificates by default for communication between components such as primary and replica instances and the web tier. However, if your AM deployment was originally installed on a version earlier than 8.2, upgrading to AM 8.2 does not automatically update the internal certificates — they remain SHA-1. If your organization requires SHA-256 certificates for all network connections, use this procedure to upgrade the internal certificates using the rsautil manage-ssl-cert command-line utility.

Prerequisites — Before You Begin:

• You must have Operations Console Administrator credentials
• You must have the rsaadmin operating system password for the primary instance and each replica instance
• Secure Shell (SSH) must be enabled on every appliance in your deployment 
  https://community.securid.com/s/article/Enable-Secure-Shell-on-the-Appliance-bf9a6052

This procedure covers multiple tasks depending on your deployment. Review the table below and complete all tasks that apply to your environment.

Task 1: Upgrade Certificates on the Primary Instance

1. Launch an SSH client and connect to the primary instance using its IP address or fully qualified hostname.
2. Log in with the rsaadmin operating system credentials.
3. Navigate to the rsautil directory:
   

   cd /opt/rsa/am/utils/

4. Run the certificate upgrade utility:
   

   ./rsautil manage-ssl-cert --regen-internal-ca

5. When prompted, enter your Operations Console Administrator User ID.
6. When prompted, enter your Operations Console Administrator password.
7. Confirm the upgrade completed successfully. The following output appears:
   

   Created backup of current keystores at: /opt/rsa/am/server/security/JKS_BACKUP_number
   Customer-provided SSL certificates were retained.
   Created primary keystore ZIP: primary-keystores.zip
   Command completed successfully.

8. Copy primary-keystores.zip to the /opt/rsa/am/utils/ directory on each replica instance:
   

   scp /opt/rsa/am/utils/primary-keystores.zip rsaadmin@<replica-hostname>:/opt/rsa/am/utils/

9. Navigate to the server directory:
   

   cd /opt/rsa/am/server

10. Restart all services on the primary instance:
    

    ./rsaserv restart all

    CAUTION: The following step restarts all AM services on the primary instance. This will cause a brief service interruption. Ensure this is performed during a maintenance window.

     
11. Close the SSH session on the primary instance:
    

    exit

Task 2: Upgrade Certificates on Each Replica Instance

1. Launch an SSH client and connect to the replica instance using its IP address or fully qualified hostname. 
2. Log in with the rsaadmin operating system credentials. 
3. Navigate to the rsautil directory:
   

   cd /opt/rsa/am/utils/

4. Run the certificate upgrade utility with the primary keystore ZIP:
   

   /rsautil manage-ssl-cert --regen-internal-ca --keystore-zip primary-keystores.zip

5. When prompted, enter your Operations Console Administrator User ID.
6. When prompted, enter your Operations Console Administrator password.
7. Confirm the upgrade completed successfully. The following output appears:
   

   Created backup of current keystores at: /opt/rsa/am/server/security/JKS_BACKUP_number
   Command completed successfully.

8.  Navigate to the server directory: 
   

   cd /opt/rsa/am/server

9. Restart all services on the replica instance:
   

   ./rsaserv restart all

   CAUTION: The following step restarts all AM services on the replica instance. This will cause a brief service interruption. Ensure this is performed during a maintenance window.

10.  Close the SSH session on the replica instance: 

    exit

11.   Repeat Steps 1-10 Task 2 for each remaining replica instance in your deployment.

Task 3: Re-install the Web Tier (if applicable)

NOTE: This task applies only if your deployment includes a web tier. After upgrading the internal certificates on the primary and replica instances, the web tier must be re-installed and the virtual host must be re-enabled. Refer to the RSA Authentication Manager 8.2 Installation and Configuration Guide for web tier re-installation steps.

Task 4: Regenerate Authentication Agent Configuration Files (if applicable)

NOTE: This task applies if your deployment includes IPv4/IPv6 authentication agents or custom agents built with the RSA Authentication Agent API 8.5 or later for C or Java. After upgrading the internal certificates, you must generate and distribute new configuration files to all affected agents. Refer to the RSA Authentication Manager 8.2 Administration Guide for configuration file regeneration steps.

Task 5: Update Trusted CAs (if applicable)

NOTE: This task applies if your environment includes web browser access to the Operations Console or RSA Authentication Manager Prime administrative SDK connections. After upgrading the internal certificates, add the new certificates to the trusted CA list in your web browser and in any AM administrative SDK connection configurations. Refer to the RSA Authentication Manager 8.2 Administration Guide for trusted CA management steps.

Verification: 

• Confirm authentication agents are connecting successfully to the primary and replica instances by testing an authentication requests from your authentication agents.
• Run your vulnerability scanner against the Authentication Manager primary and replica instances and confirm the SHA-1 certificate vulnerability no longer appears in the scan results. The internal certificates should now be reported as SHA-256 (SHA256withRSA).