The document explains how to generate and add new Detection Server certificates using SSLkeytool.
Enforce:
Detection Server:
cd C:\Program Files\Symantec\DataLossPrevention\EnforceServer\15.8.00000\Protect\bin\
sslkeytool.exe -genkey -dir="C:\Program Files\Symantec\DataLossPrevention\EnforceServer\15.8.00000\Protect\bin"
Now at this time there will be 2 new certificates created in the directory, one for the Enforce and the other one for the detection server.
5. Copy the new Enforce Server certificate file to the <C:\ProgramData\Symantec\DataLossPrevention\EnforceServer\15.8.00000\keystore> directory on the Enforce Server.
6. Copy the new Detection Server certificate file to the <C:\ProgramData\Symantec\DataLossPrevention\DetectionServer\15.8.00000\keystore> directory on the Detection Server.
7. Delete or secure any additional copies of the certificate files to prevent unauthorized access to the generated keys.
8. Restart the DetectionServer service on each Detection Server to use the new certificate file.
9. Restart the Symantec DLP Services on Enforce to start using the new key