AEK configuration during Repository configuration in Documentum

Suganya Baskar · 2021-10-21T08:42:43+00:00

There was an error rendering this rich post.

Hi All,

Global registry configuration with AEK is completed. While creating the other repository on the same server. We are getting the below error for AEK. Even after giving the below values under configuration file

common.use.existing.aek.lockbox=common.create.existing

common.use.existing.aek=common.create.existing

04:14:07,064 ERROR [main] com.documentum.install.server.installanywhere.actions.DiWAServerCreateKeyStore - The keystore file with same name exists:

/u/opt/documentum/dba/secure/CSaek

Please assist how to overcome with this error.

Find more posts tagged with

Comments

Hicham Bahi

That's because your silent installation file specifies to create another key. I don't remember the correct value for using the existing one but I think it's

common.use.existing.aek=common.use.existing

Also you probably don't want to use Lockbox as this has been deprecated. You should perhaps do a manual installation first and record your choices the first time, so that you get all the parameter values which are right for you.

Suganya Baskar

@bacham3 Thanks for the above inputs. Please let me know whether

common.use.existing.aek=common.use.existing is alone suffice or we need to include the below parameters alone with it.

common.aek.passphrase.password=**********

common.aek.key.name=CSaek

common.aek.algorithm=AES_256_CBC

Hicham Bahi

As far as I know the key name and algorithm are mandatory. As for the password, if you leave it blank it will use the default password which is fine for most customers. If you set it, then you will need to run dm_crypto_boot and enter the password before launching your docbases. Checkout the documentation for more information.

Suganya Baskar

Hi ,

If we use AEK algorithm as common.aek.algorithm=AES_128_CBC during installation, then the r_crypto_mode = AES128_RSA1024_SHA256 ?

Please correct if any modifications needed in selecting the modes.

Hicham Bahi

Yes that looks correct

Suganya Baskar

@bacham3 thanks!

Could you please assist to fix this issue occurred during Documentum 21.4 install

error while loading shared libraries: libdmNetwork.so: cannot open shared object file: No such file or directory

Suganya Baskar

During the fresh install of Documentum 21.4 ,This is the new instance of CS. The global registry configuration is failing with the below error:

2021-11-19T09:03:12.975919 248443[248443] 0000000000000000 [DM_SERVER_F_CANT_CREATE_TICKET_MANAGER]fatal: "Unable to create ticket manager on server startup. Likely reason is corrupted aek.key file or docbase config object. The server will shutdown."

AEK Information on configuration file is as follows :

common.use.existing.aek=common.create.new

common.aek.key.name=CSaek

common.aek.algorithm=AES_128_CBC

And the r_crypto_mode = AES128_RSA1024_SHA3_384 got loaded in server.ini

Suganya Baskar

Could somebody help on this with a workaround.

DCTM_Guru

Have you tried just deleting aek (or backing it up somewhere else)? The CS will automatically generate a new one if one doesnt already exist.

Suganya Baskar

@DCTM_Guru yes tried to delete /backup CSaek. And started the repository.

Unfortunately getting the below error :

2021-11-19T15:47:13.379701 268435[268435] 0000000000000000 [DM_CRYPTO_F_KEYSTORE_INIT]fatal: "Failed to initialize keystore at /u/opt/documentum/dba/secure/CSaek. Internal error - 1057226525"

Kindly assist further

Hicham Bahi

If you already created a repository, it's not a good idea to delete CSaek!

Can you perhaps explain what you are trying to do? Seems like you are performing a silent installation?

Suganya Baskar

@bacham3

I am doing a Documentum 21.4 fresh silent installation. I am working on Global registry configuration.

As I ran ./dm_launch_server_config_program.sh -f linux_config_GR.properties

AEK Information on configuration file is as follows :

common.use.existing.aek=common.create.new

common.aek.key.name=CSaek

common.aek.algorithm=AES_256_CBC

The repository seems to be created but facing the below issues:

Hicham Bahi

common.create.new will create a new aek key. So if one already exists, it will probably overwritten. And if your docbase was already created, then it will not work anymore. Perhaps you should first make a manual installation while recording the parameters, and then use that as the basis for future installations.

Suganya Baskar

@bacham3 Could you please help us with the steps for manual installation or Please share KB regarding this procedure.