Unable to remove a VIP or SSL Certificates from VIP Enterprise Gateway. Certificate is In Use.

Products

• VIP Service

Issue/Introduction

In the VIP Gateway > Setting, the VIP Certificate or other SSL Certificate cannot be removed or changed. 

 Failed to delete 'certname' 

When viewing the Cert:

Invalid input string format.  Check the input for invalid characters and try again

Cause

Possible corruption in the VIP key store. 

Resolution

Note: An active SSL cert showing in use as Yes cannot be deleted until all services (Enterprise Gateway Console, Healthcheck, SSP or VIP Manager IdP) using that cert are set to use another SSL cert, or the HTTPS option is disabled (HTTP). An SSL cert change will require a service restart.   

 

To avoid access denied errors, the In Use status should show as No.  Proceed with these steps only if all other steps to free up the SSL certificate have failed:

1. Open a Symantec Support case. 
2. From an elevated command prompt: Navigate to \Program Files (x86)\Symantec\VIP_Enterprise_Gateway\server\Webapps\configs,  then send the ManagedAuthentication.xml file to technicians assigned to the case.
3. Navigate to \Program Files (x86)\Symantec\VIP_Enterprise_Gateway, then send the license.txt file to the technician assigned to the case. 
4. The technician will respond with the decrypted password for the DEFAULT and (if necessary) VIPCDK keystores. 
5. Open an elevated cmd prompt and navigate to \Program Files (x86)\Symantec\VIP_Enterprise_Gateway\server\keystore
6. Run the following:
   
   "C:\Program Files (x86)\Symantec\VIP_Enterprise_Gateway\jvm\bin\keytool" -list -keystore DEFAULT.
    
7. When prompted, enter the password for the DEFAULT key store.
8. Make note of the certificate(s) that needs to be removed.
9. Run the following:
   
   "C:\Program Files (x86)\Symantec\VIP_Enterprise_Gateway\jvm\bin\keytool" -delete -noprompt -alias <name of cert to be removed> -keystore DEFAULT.
   ​
10. When prompted, enter the password.
11. If removing the VIP certificate, repeat the steps with the VIPCDK key store.
12. Restart the Symantec VIP Enterprise Gateway service.