Lost Cluster CA, how to recover it?

[HoaNguyen]

Hi support team, We have the MWG cluster with many nodes and going to add the new node. Unfortunately, we have no exported Cluster CA in our hand so I can not add to new node and join to cluster. Is there anyway to recover it? Or generate the new CA without any impact? Thanks.

[jacek]

Login over SSH to one of existing Cluster nodes.

You should check, where is your current configuration. Full path to current configuration in inside file: /opt/mwg/storage/active_configuration

cat /opt/mwg/storage/active_configuration

Change directory to current configuration:

cd `cat /opt/mwg/storage/active_configuration`

Enter "cfg" subdirectory:

cd cfg

Find file, where Cluster CA certificate is stored (switch for grep command is lowercase "L" letter):

grep -l "Cluster CA certificate" com.scur.engine.*

Grep command will return filename, where Cluster CA certificate is stored, eg:

com.scur.engine.sslclientcontext.1064.xml

CA certificate is in line starting with:

<configurationProperty key="CACert" 

Key for this certificate is in line, but keep in mind, that this key is probably stored in encrypted form, so you cannot recover them to readable format:

<configurationProperty key="CAKey" 

The values for CACert and CAKey are merged to one line. Replace "
" to a new line.

But probably creating a backup of existing configuration and restoring it to a new node, should restore also Cluster CA certificate with a matching key.

[Bradlee_Cox]

If you generate a new Cluster CA on one of the clustered members, they all get updated with that Cluster CA at the time of creation. 

You can then use the new Cluster CA to add a new device to the cluster.

This saves you from needing to securely save a cluster CA forever.