More SSL fun stuff

[Mita201]

I have noticed that since SSL is mandatory for ISP client server communication (8.1.4 or 7.1.8) if you have two ISP servers that replicates, and if you want to shut down primary and to test if (new) client can communicate with other server for restore - it can't. You need to manually import SSL certificate of other server to client keystore first.
Which is not very clever solution.
Not a question, just noticing....

 

[ILCattivo]

Hi Mita201,

Have you tested that scenario with a variety of client versions?

What about clients which are pre- v7.1.8, that communicate to a replicating server environment at v7.1.8 & 8.1.2 and above, which connect via TCP/IP?

 

[Mita201]

Older clients are ok, since they are not forced to use SSL. Clients 8.1.2 and newer, and 7.1.8 are clients with problems. Actually, these new clients (at least 8.1.x) will do certificate exchange with primary server without intervention, and they will update their dsm.opt (or dsm.sys) with address of the secondary server as alternative, but once they need to access it, they will not be able to, nor they will import SSL cert of the secondary server automatically.

 

[ILCattivo]

Older clients are ok, since they are not forced to use SSL. Clients 8.1.2 and newer, and 7.1.8 are clients with problems. Actually, these new clients (at least 8.1.x) will do certificate exchange with primary server without intervention, and they will update their dsm.opt (or dsm.sys) with address of the secondary server as alternative, but once they need to access it, they will not be able to, nor they will import SSL cert of the secondary server automatically.

Hmmm, thanks for the info.

That certainly doesn't sound good or has not been thought out very well from a DR standpoint since the intro of 7.1.8 & 8.1.2.

I can see many admins now rushing around their newer client versions, importing the cert for the secondary server to avoid this issue in the event of DR.

Oh, well.. things like this keep us all in a job I guess.. ;0)

 

[RecoveryOne]

Mita,
Thanks for the info. Something to look forward to whenever I bite the bullet and go up a level.