The certificate on IBM Spectrum Protect backup server sdc-busrv02.umd.edu will expire June 2, 2021 8:00:00 AM.  In order to prepare for a transition to a new root certificate provider, our testing has indicated that existing clients need to manually install the root and intermediate certificates for Incommon-signed certificates.  Please, follow the instructions below to install the certificate on each IBM Spectrum Protect client by 06/01/2021.

Determine if a system is impacted

Windows:

View the default dsm.opt (C:\Program Files\tivoli\tsm\baclient\dsm.opt) file for the following parameter and value:

TCPSERVERADDRESS sdc-busrv02.umd.edu

Linux:

View the dsm.sys (/opt/tivoli/tsm/client/ba/bin/dsm.sys) file for the following parameter:

TCPSERVERADDRESS sdc-busrv02.umd.edu

Root certificate installation for Windows TSM clients

1.

• Attached to this article are the root and intermediate CA certs. Scroll down to the attachments section to download them. 
• Place them at  /Program Files/Tivoli/TSM/baclient/
• Run the Command Shell (cmd) as Administrator.
• Navigate to the following directory: cd /Program Files/Tivoli/TSM/baclient
• Run the following commands:
  
  • dsmcert -add -server sdc-busrv02.umd.edu -file incommon_comodo_interm.arm
  • dsmcert -add -server sdc-busrv02.umd.edu -file incommon_intermroot.arm
• To verify for TSM clients, run the following command:
  
  • dsmc q sched

2.

• IF you install the certificate successful , but still not connecting to sdc-busrv02.umd.edu do the following
• cd /Program Files/Tivoli/TSM/baclient/
• Remove the following files, if they exist:

   dsmcert.crl

   dsmcert.idx

   dsmcert.kdb

   dsmcert.rdb

   dsmcert.sth

•    Run the following to verify TSM clients connection to the right server
  
  • dsmc q sched
  • Restart TSM Acceptor service 

3.

If you get the "ANS1592E Failed to initialize SSL protocol."

• after you remove the dsmcert files listed above 
• please place cert256.arm file to C:\Program Files\Tivoli\TSM\baclient
• dsmcert -add -server sdc-busrv02.umd.edu -file cert256.arm
  
  • Run the following to verify TSM clients connection to the right server
    
    • dsmc q sched
    • Restart TSM Acceptor service 

Root certificate installation for Unix/Linux servers 

1. Navigate to the following directory: cd /opt/tivoli/tsm/client/ba/bin
2. Run the following commands:
   
   • dsmcert -add -server sdc-busrv02.umd.edu -file /<pathtoincomdir>/incommon_comodo_interm.arm
   • dsmcert -add -server sdc-busrv02.umd.edu -file /<pathtoincomdir>/incommon_intermroot.arm
3. To verify for TSM clients, run the following command:
   
   • dsmc q sched