Unable to delete an expired certificates from Siteminder Admin UI

Products

• SITEMINDER

Issue/Introduction

When trying to delete an expired certificate from admin UI, getting error:

"Selected item is in use and cannot be deleted".

However in admin UI, this certificate shows no dependencies of any partnership.

If attempt to delete the same cert from XPSExplorer:

(Error): [sm-xpsxps-03340] Cannot delete a related record. (CA.Fed::Certificate@0034.......:CA.FED::EncryptionConfig@0004306a-####-####-####-65d207210000.CA.FED::EncryptionConfig.EncryptCertLink)

DELETE FAILED.

Environment

SiteMinder: ALL version

Cause

Data corruption due to orphaned  "CA.FED::EncryptionConfig" object.

A certificate can be used for "Verification" or "Encryption".

Before deleting a cert, it must be removed from any link reference within an existing partnership.

If not, then the old "CA.FED::EncryptionConfig" could be left orphaned, which has the bad EncryptCertLink.

A "CA.FED::EncryptionConfig" should ALWAYS be referenced by an existing partnership.

The sign it is orphaned, is because each CA.FED::PartnershipBase already has new legit CA.FED::EncryptionConfig linked to it, which points to a new cert alias as EncryptCertLink.

The orphaned  "CA.FED::EncryptionConfig" does not associate with any existing partnership.

 

Resolution

A certificate can not be deleted due to orphaned CA.FED::EncryptionConfig -->CA.FED::EncryptionConfig.EncryptCertLink--> the expired cert XID.

Using XPSExplorer, delete above orphaned CA.FED::EncryptionConfig objects by matching its xpsGUID 0004306a-####-####-####-65d207210000.

Then delete the old cert from admin UI.