When you install a new SSL certificate on Cryptographic Security Platform Vault, Cryptographic Security Platform Vault automatically updates the associated CA certificate on all registered VMs. If a Windows boot-drive-encrypted VM was inaccessible during this process, that VM may not be able to boot because the CA certificate the VM is using can no longer verify the Cryptographic Security Platform Vault SSL certificate. This means that the VM cannot retrieve the proper keys from Cryptographic Security Platform Vault because it cannot verify the communication coming from Cryptographic Security Platform Vault.

To fix this issue you need to manually update the CA certificate on the VM so that it can verify the SSL certificate Cryptographic Security Platform Vault is currently using. This allows the VM to verify Cryptographic Security Platform Vault's identity and to retrieve the appropriate keys.

The following procedure is for Windows VMs with an encrypted boot drive. For other types of VMs, see Manually Updating the CA Certificate on a Linux Root Drive Encrypted VM or Manually Updating the CA Certificate on a Data Encrypted VM.

Procedure 

1. If you need a copy of the CA certificate that can verify the SSL certificate that Cryptographic Security Platform Vault is currently using: 

   1. Log into the Cryptographic Security Platform Vault Management webGUI with your standard account credentials.

   2. Select ? > Download CA Certificate.

      The Cryptographic Security Platform Vault downloads a pem file to your browser's default download location.

   Note: If you are using an externally signed SSL certificate for Cryptographic Security Platform Vault, make sure that you use the CA certificate you download from the Cryptographic Security Platform Vault Management webGUI on all registered VMs. Do not use the CA certificate that you received from the external certificate authority.

2. If needed, reboot the VM and wait for the Console menu to appear.

   If you are unable to view the console directly, for example in environments such as Amazon Web Services (AWS), you can access the console using an SSH client. This requires the id_rsa key file generated during the Policy Agent installation. Copy the id_rsa file to the server an then reboot.

   Tip: If you need another copy of the id_rsa key file, you can download it from the Cryptographic Security Platform Vault webGUI by selecting the VM on the Cloud > VMs tab and then selecting Actions > Download Bootloader SSH Key.

3. From the Console menu, select Drop to shell.
4. Copy the Cryptographic Security Platform Vault for VM Encryption certificate pem file to the VM.

5. Enter the command hcl update_ca -f /path/to/cert.pem, where /path/to/cert.pem is the path to the certificate file.

   # hcl update_ca -f /etc/ssl/certs/171012172410_cacert.pem
   				
   Updating using cert file at: 171012172410_cacert.pem
   Updated CA certificate
   

6. After the certificate is successfully updated, enter the command touch /opt/hcs/etc/updatecert to tell the hcl service that the certificate has changed. The hcl service then syncs the change from the Bootloader back to the client installation directory.

   # touch /opt/hcs/etc/updatecert
   

7. Enter the command exit to leave the secure shell.
8. Select Boot Windows with encryption key. Cryptographic Security Platform Vault reboots the VM using the updated Cryptographic Security Platform Vault certificate.
9. If the VM reboots but displays an error that it needs to be authenticated, select Reauthenticate from the Console menu.

10. To verify that the VM is connected to Cryptographic Security Platform Vault:

    1. Open a Command Prompt on the VM.
    2. Enter hcl heartbeat to force the VM to communicate with Cryptographic Security Platform Vault and update the connection status.
    3. Enter hcl status to verify the connection status.

    C:\users\administrator> hcl heartbeat
    C:\users\administrator> hcl status
    
    Summary
    --------------------------------------------------------------------------------
    KeyControl: 10.238.65.65:443
    KeyControl list: 10.238.65.65:443 10.238.65.66:443
    KeyControl Mapping: kc41-nodes
    Status: Connected
    Last heartbeat: Tue Oct 24 22:30:32 2017 (successful)
    AES_NI: enabled
    Certificate Expiration: Sep 11 22:16:13 2020 GMT