<h2>Truststore Migration for MID Server</h2><br/><div style="overflow-x:auto"><article><div ><h3 >Issue </h3><section><ul><li>MID server is a Java application shipped with a bundled JRE.<br /><br /></li><li>Within the JRE there is a file called <em><strong>cacerts</strong></em> also known as <em><strong>JRE Truststore</strong></em>.<br /><br /></li><li>The unmodified <em><strong>cacerts</strong></em> file contains trusted root certificates signed by the certificate authorities and the JVM uses these to establish SSL or TLS encrypted connections with the other systems<br /><br /></li><li>As the certificates expire or revoked they are removed from the JRE.<br /><br /></li><li>Different versions of JRE will have different contents in their Truststore.<br /><br /></li><li>During the mid upgrade following the download and the extraction of packages, the mid server overwrites the files targeted for update.<br /><br /></li><li>So, in the event of JRE upgrade if happens as part of the MID upgrade, the original cacerts file is overwritten and any self-signed certificates that the client had uploaded will be lost, and they have to re-uploaded post upgrade.<br /><br /></li><li>This is fixed in <em><strong>Quebec</strong></em> by identifying and migrating the self-signed certificates found in the original Truststore and migrate them to the incoming JRE from the upgrade.<br /><br /></li><li>Backups from the existing <em><strong>cacerts</strong></em> is also taken during this process<br /><br /> <ul><li>Backup of the original bundled JRE’s Truststore is created<br /><br /></li><li>The existing Truststore certificates re filtered for self-signed certificates <br /><br /></li><li>A backup of the incoming upgrade JRE’s Truststore is created.<br /><br /></li><li>Self-signed certificates are imported into incoming upgrade JRE’s Truststore with an <em><strong>“sac-”</strong></em> string prepended.<br /><br /></li></ul> </li><li>This is only present for the upgrades of the bundled JRE but not If the customer is managing the JRE outside the MID bundled package.<br /><br /></li><li>What backups are created and where ?<br /><br /> <ul><li>Original Truststore, which will be renamed to “<em><strong>cacerts_before</strong></em>”<br /><br /></li><li>Incoming Truststore, which will be renamed to “<em><strong>cacerts_from_upgrade</strong></em>”<br /><br /></li><li>Created under <em><strong>/agent/work/truststore_migration/<epoch timestamp></strong></em><br /><br /></li><li>Backups are created only in the event of JRE upgrade (but for not all MID upgrades where the JRE upgrade is not happening)<br /><br /></li></ul> </li><li>The details of the certificate migration (successful/failure) during the upgrade will be captured in the agent logs something like below<br /><br /> <ul><li>AutoUpgrade.3600 Not migrating X.509 cert<br /><br /></li><li>AutoUpgrade.3600 Migrating X.509 cert<br /><br /></li><li>AutoUpgrade.3600 TrustStore migration complete<br /><br /></li></ul> </li><li>The same is as well tracked in the MID Server Upgrade History table with the name “<em><strong>MigrateTrustStore</strong></em>” and the associated states being Completed, Failed and Skipped</li></ul></section></div><div ><h3 >Related Links</h3><section><ul><li>What if the default password of the cacerts file is changed and can that be read during the upgrade ?<br /><br /> <ul><li>The cacerts will have to have the default password in place and using the default password is mandatory.</li></ul> </li></ul></section></div></article></div>