Skip to main content
ONTAP Mediator

Switch ONTAP Mediator to the legacy CA certificate common name

Contributors netapp-aoife netapp-camdenc
PDFs

Beginning with ONTAP Mediator 1.13, the self-signed CA certificates include a per-installation identifier in their common name. If your ONTAP Mediator instance must pair with an ONTAP release that does not recognize this identifier, switch to the legacy fixed common name.

By default, the ONTAP Mediator CA certificates carry a per-installation identifier in their common name, for example ONTAP Mediator CA 1a2b3c4d. This enables you to register several ONTAP Mediator instances with the same ONTAP cluster, because ONTAP refuses to install two CA certificates that share a subject name but hold different keys.

The following ONTAP releases locate the ONTAP Mediator CA by matching the common name exactly and do not recognize the identifier:

  • ONTAP 9.11.1 and earlier

  • ONTAP patch releases earlier than 9.12.1P15, 9.13.1P12, 9.14.1P8, and 9.15.1P2

If an ONTAP Mediator instance must pair with one of these releases, use the legacy fixed common name.

About this task

  • Perform this task on the Linux host where you installed ONTAP Mediator.

  • While the legacy common name is in effect, you can register only one ONTAP Mediator instance per ONTAP cluster.

Steps

  1. Add the following line to the /opt/netapp/lib/ontap_mediator/ontap_mediator/server_config/ontap_mediator.user_config.yaml file. This file is preserved across ONTAP Mediator upgrades.

    'generate_unique_ca_name': false

  2. Regenerate the certificates:

    [root@localhost ~]# cd /opt/netapp/lib/ontap_mediator/ontap_mediator/server_config/; ./make_self_signed_certs.sh overwrite

  3. Restart the service:

    [root@localhost ~]# sudo systemctl restart ontap_mediator

  4. On every paired ONTAP cluster where self-signed CA certificates are used, perform the following actions:

    1. Remove ONTAP Mediator.

    2. Delete the previously installed CA certificates.

    3. Install the regenerated root_ca.crt and intermediate.crt certificates.

    4. Add ONTAP Mediator again.

      Caution Regeneration always produces new keys, so you must delete the old CA certificates first. If you leave them in place, ONTAP retains a CA that no longer signs the server certificate. Newer ONTAP releases also reject the installation of the replacement CA certificates because the new and old certificates share the same subject name.