Manually Updating the CA Certificate on a Windows Boot Drive Encrypted VM

When you install a new SSL certificate on KeyControl, KeyControl automatically updates the associated CA certificate on all registered VMs. If a Windows boot-drive-encrypted VM was inaccessible during this process, that VM may not be able to boot because the CA certificate the VM is using can no longer verify the KeyControl SSL certificate. This means that the VM cannot retrieve the proper keys from KeyControl because it cannot verify the communication coming from KeyControl.

To fix this issue you need to manually update the CA certificate on the VM so that it can verify the SSL certificate KeyControl is currently using. This allows the VM to verify KeyControl's identity and to retrieve the appropriate keys.

The following procedure is for Windows VMs with an encrypted boot drive. For other types of VMs, see Manually Updating the CA Certificate on a Linux Root Drive Encrypted VM or Manually Updating the CA Certificate on a Data Encrypted VM.

Procedure 

1. If you need a copy of the CA certificate that can verify the SSL certificate that KeyControl is currently using: 

   1. Log into the KeyControl webGUI using an account with Cloud Admin privileges.
   2. In the top menu bar, click Cloud.

   3. Select Actions > Download CA Certificate.

      KeyControl downloads a pem file to your browser's default download location.

   Note:

   If you are using an externally signed SSL certificate for KeyControl, make sure that you use the CA certificate you download from KeyControl on all registered VMs. Do not use the CA certificate that you received from the external certificate authority.

2. If needed, reboot the VM and wait for the Console menu to appear.

   If you are unable to view the console directly, for example in environments such as Amazon Web Services (AWS), you can access the console using an SSH client. This requires the id_rsa key file generated during the Policy Agent installation. Copy the id_rsa file to the server an then reboot.

   Tip:

   If you need another copy of the id_rsa key file, you can download it from the KeyControl webGUI by selecting the VM on the Cloud > VMs tab and then selecting Actions > Download Bootloader SSH Key.

3. From the Console menu, select Drop to shell.
4. Copy the KeyControl certificate pem file to the VM.

5. Enter the command hcl update_ca -f /path/to/cert.pem, where /path/to/cert.pem is the path to the certificate file.

   # hcl update_ca -f /etc/ssl/certs/171012172410_cacert.pem
   				
   Updating using cert file at: 171012172410_cacert.pem
   Updated CA certificate
   

6. After the certificate is successfully updated, enter the command touch /opt/hcs/etc/updatecert to tell the hcl service that the certificate has changed. The hcl service then syncs the change from the Bootloader back to the client installation directory.

   # touch /opt/hcs/etc/updatecert
   

7. Enter the command exit to leave the secure shell.
8. Select Boot Windows with encryption key. DataControl reboots the VM using the updated KeyControl certificate.
9. If the VM reboots but displays an error that it needs to be authenticated, select Reauthenticate from the Console menu.

10. To verify that the VM is connected to KeyControl:

    1. Open a Command Prompt on the VM.
    2. Enter hcl heartbeat to force the VM to communicate with KeyControl and update the connection status.
    3. Enter hcl status to verify the connection status.

    C:\users\administrator> hcl heartbeat
    C:\users\administrator> hcl status
    
    Summary
    --------------------------------------------------------------------------------
    KeyControl: 10.238.65.65:443
    KeyControl list: 10.238.65.65:443 10.238.65.66:443
    KeyControl Mapping: kc41-nodes
    Status: Connected
    Last heartbeat: Tue Oct 24 22:30:32 2017 (successful)
    AES_NI: enabled
    Certificate Expiration: Sep 11 22:16:13 2020 GMT