-
Title
How To Generate SHA-2 Certificates in Rapid Recovery -
Description
If you need to regenerate self-signed SHA-2 certificates for Rapid Recovery, follow this process. This may be necessary if the certificates have expired or if there are errors related to mismatched certificates during replication.
Common Error Example: Error: "Core ID mismatches with client certificate."
-
Cause
When certificates are not regenerated, Rapid Recovery may still use SHA-1 certificates, or expired certificates may cause issues during replication. -
Resolution
Important: Windows Registry Disclaimer
Quest does not provide support for issues caused by improper modification of the Windows registry. The registry contains critical information for your system and applications, so ensure you back up the registry before making any changes.
For more information on how to back up and restore the Windows registry, refer to Microsoft Article ID 256986 – Description of the Microsoft Windows Registry.
Steps to Regenerate Self-Signed SHA-2 Certificates
1. Stop Services
- Stop the Rapid Recovery Core Service.
- If your Core is a DL Appliance, stop the DL Appliance SRM Web Service.
2. Delete Existing Certificates
Open the Windows Registry and browse to the following location:
HKLM\Software\Apprecovery\Core\CertificateService\Delete the following registry keys:
LocalClientCertificateLocalClientThumbprintLocalServerCertificateLocalServerThumbprint
3. Restart Services
- Start the Rapid Recovery Core Service.
- If your Core is a DL Appliance, start the DL Appliance SRM Web Service.
Note: After restarting the services, all agents and replications will display a "red" error status.
4. Repair Agents
- In the Core Console, click on Protected Machines.
- For each machine showing a red status (Error), click the dropdown menu and select Repair.
- This action will pair the Core and the Agent with new self-signed SHA-2 certificates. The machine's status will turn green (Online) when the process is complete.
5. Repair Replication
- On the Source Core, go to Replication.
- Under each Outgoing Replication, select the Target Core and click Delete.
- On the Target Core, go to Replication.
- Under Incoming Replication, select the Source Core and click Delete.
Important: DO NOT select the "Delete existing recovery points" box, as this will automatically delete all replicated recovery points. Click Yes to continue removing the replication.
- On the Source Core, re-add the Target Core and Agents back into replication. This will pair the Cores with new self-signed SHA-2 certificates.