Web Services Security Guides › CA SiteMinder® Web Services Security Upgrade Guide › Upgrading from CA SOA Security Manager r12.1 SP3 › How to Migrate from SOA Security Manager r12.1 SP3 › Synchronize Key Database Instances

More information:

CA SiteMinder® Key Tool

Synchronize Key Database Instances

Synchronize all smkeydatabase instances before beginning the migration to a new version.

Note: Use the smkeytool utility to synchronize the smkeydatabases and resolve all data inconsistencies between smkeydatabase instances. For more information about the smkeytool utility, see the Policy Server Administration Guide.

Previous versions of CA SiteMinder® used a local smkeydatabase to store certificate data. Each Policy Server required its own smkeydatabase. For version 12.52 SP1, a centralized certificate data store replaces the local smkeydatabases.

As part of a Policy Server upgrade, the installer automatically backs up the local smkeydatabase and tries to migrate all content to the certificate data store. This process includes a comparison of both stores before starting the migration.

Important! If the migration of the smkeydatabase fails, do not return the Policy Server to the environment. Returning the Policy Server after a failed migration causes all transactions that require the certificate data to fail.

Use the following guidelines to identify and resolve data consistencies among your smkeydatabases:

• Verify that each certificate‑authority certificate references certificate revocation lists consistently across instances.

  Example: A certificate‑authority certificate consistently references certificate revocation lists in an LDAP directory service.

• Verify that the defaultentpriseprivatekey alias represents the same private key/certificate pair in all instances.
• Verify that the same alias maps to the same certificate or key/certificate pair.
• Verify that the same certificate‑authority certificates map to the same certificate revocation lists.
• Verify that a revoked or expired certificate is not present.
• Verify that all CRL information is valid.

Important! After you resolve all data inconsistencies, we recommended that you do not modify a smkeydatabase until all migrations are complete.