Symantec DCS (Data Center Security) relies on rest APIs (application programming interface) to receive and respond to requests made via the UMC (Unified Management Console), Java Console (also known as the policy editor), and other API calls made directly to the web-based listener service. This article covers the application layer of communication. For issues related to presentation and session layer issues, or lower, refer to the following articles:
Transport layer (TCP): https://knowledge.broadcom.com/external/article?legacyId=TECH237122
Presentation layer (SSL client/server trust): https://techdocs.broadcom.com/us/en/symantec-security-software/endpoint-security-and-management/data-center-security-(dcs)/6-9/installing-upgrading-v127913953-d3608e151987/installing-the-unified-management-console-root-ca-v127944020-d3608e165515.html
Symantec Data Center Security (DCS) Manager
*4443 is the default port used by DCS for API communications. Although this issue is technically on the presentation layer (and on up) it presents as an application-level error when the call is made from UMC or the Java Console.
A backup of all the DCS Manager files, and its database should be performed regularly, this article implies that regular backups of the DCS Manager(s) and database have taken place. For details on how to perform a full backup see: https://knowledge.broadcom.com/external/article/159322/backup-and-restore-dcs-database-for-disa.html
For the services starting too soon issue, there is a quick resolution: Simply restart the DCS Manager services followed by the two UMC services:
In order to mitigate for this potential issue, consider setting the following services from the Microsoft Services (services.msc) to "Automatic (Delayed Start)"...
For example:
Note: This mode means the service will start after a short wait for other Windows services marked as Automatic.
Since there are several 3rd party articles which cover the mechanics of adding a trusted CA (certificate authority / self-signed / certificate) to a JKS (and other keystore types), we will cover how to identify and extract the necessary certificate(s) from the PKCS#12 (Public Key Cryptography) utilized by DCS, including step-by-step instructions on how to add these to the trusted keystore used by the JRE (Java runtime environment) installed with DCS.
Note: DCS names the extensions for its PKCS12 stores from the standard ".pfx" or ".p12" to ".ssl". The only exception to this is the produced agent-cert.ssl which is a BASE64 encoded issued certificate, and does not contain a private key or keystore indexing. For the remaining steps of this article we will create a folder named "Example" in the "C:\" drive (C:\Example). Any name(s) may be used, just remember to modify your actual commands accordingly.
cd C:\Program Files (x86)\Symantec\Data Center Security Server\Server\jre\bin
C:\Program Files (x86)\Symantec\Data Center Security Server\Server\jre\bin>keytool.exe -keystore "C:\Example\sss.ssl" -storepass "CdlxmLPSnCng65ttkeXXXtWhAS4fIlfuRlanOXxc" -storetype PKCS12 -list
keytool.exe -keystore "C:\Example\sss.ssl" -storepass "CdlxmLPSnCng65ttkeXXXtWhAS4fIlfuRlanOXxc" -storetype PKCS12 -list -alias sss -rfc
cd C:\Program Files (x86)\Symantec\Data Center Security Server\Server\jre\bin
keytool.exe -keystore "C:\Program Files (x86)\Symantec\Data Center Security Server\Server\jre\lib\security\cacerts" -storepass "CdlxmLPSnCng65ttkeXXXtWhAS4fIlfuRlanOXxc" -storetype JKS -import -file "C:\Example\root1.cer" -alias root1Enter yes when prompted to trust the certificate.
Important: If there are more than one DCS FE (front-end) Manager in play, you may simply copy the cacerts file from the primary Manager (or whichever the above steps were performed on) and overwrite its existing cacerts file (make a copy of the original as a backup).
This issue presents very similar to the known issue of browser certificate trust, presented with the following message:
System Error: Unable to connect to DCS: Server. Ensure that you have accepted the DCS: Server certificate in the web browser. If the problem persists, contact service administrator.
A quick method to distinguish this issue from the common browser trust issue, is to run Chrome with the --ignore-certificate-errors flag. Important: This troubleshooting method should ONLY be used as a troubleshooting isolation step, and should NOT be used to circumvent browser security.