We had to reinstall the ENTM embedded endpoint. We totally removed the endpoint and we then reinstalled it, and we imported the DMS and DH from text, but after doing so, and even if the DH__ and DH__WRITER are subscribed to the DMS, when running sepmd -L DH__WRITER we are getting the following
sepmd -L DH__WRITER CA ControlMinder sepmd v188.8.131.522 - Policy Model management
Copyright (c) 2013 CA. All rights reserved.
Initial offset: 0
Last offset: 9353072
Subscriber Errors Flag Offset Next command ========== ======= ====== ======= ============
Queue: ac_server_to_server (DMS) 0 Unavail 0 setoptions is_dh+
and nothing is actually sent to the DH__WRITER, so that no policy is deployed to the endpoints
sepmd -e DH__WRITER
02 Dec 16 12:02:16 (DH__WRITER): Queue: ac_server_to_server (DMS) setoptions is_dh+ 0 Retry
ERROR: Failed to get ssl credentials. (44569)
and setting the DMS/DH__WRITER by specifying debug_mode = 1 in the corresponding pmd.ini file produces the following message in the endpoint_managment.log?
12/05/[email protected]:36:31 ACMQ COMPONENT(0xf7ddf8e0): [INTERNAL ERROR]: ACMQ_Init failed on line: 709 with error: 'Failed to get ACMQ credentials; Error code: 44549'
12/05/[email protected]:36:31 ACMQ COMPONENT(0xf7ddf8e0): [INFORMATION]: ACMQ_Terminate : 'Terminate connection to Distribution Server'
This is caused by an incorrect or missing communications password on the ACMQ server side.
When the embedded endpoint was removed, the server communications password file, stored in /opt/CA/AccessControlShared/data/.acmqserver.dat was not recreated.
Running dmsmgr or other endpoint-related commands do not recreate the encrypted hashed password for the ACMQ server. Hence, the DH__WRITER, even though subscribed to the DMS will not be able to sync to it.
To recreate the server password in the ENTM environment you need to run
sechkey -t -server -w <pwd>
where <pwd> is your communications password, the one that was specified at installation time. After this the /opt/CA/AccessControlShared/data/.acmqserver.dat should be recreated and the system should be able to synchronize.