This section is applicable only if you want to use both CG AM and UAM to deploy and manage Security Agent for UNIX 7.5.1 and later.
New installations of Change Guardian 5.0 and later use TLS 1.1 or TLS 1.2 whereas UAM uses TLS 1.0 for communication. Upgraded versions of Change Guardian 5.0 and later still use TLS 1.0 to ensure backward compatibility. However, if the security profile in Change Guardian has been switched to profile_javos as described in Switching Security Profile, UAM cannot communicate with Change Guardian. To ensure seamless communication between Change Guardian and UAM, you must replace the iqlsacacert72.pem certificate in UAM with the iqcjavosca-bundle.pem certificate available in Change Guardian.
NetIQ recommends you to perform the procedure to replace certificates after upgrading all the components to the following minimum versions:
Change Guardian 5.0 (including all agents and policy editor clients).
Security Agent 7.5.1.
Prerequisite: Before replacing the certificates, take a backup of the iqlsacacert72.pem file from the UAM install directory: <INSTALL-DIR>/UAM/codecs/default/
Perform the following steps to replace the certificates:
Log in as root to the Change Guardian server.
Copy the iqcjavosca-bundle.pem file from the following location:
/opt/netiq/cg/javos/security/profiles/profile_iqc/
On the UAM computer, replace the iqlsacacert72.pem file from the following location:
<INSTALL-DIR>/UAM/codecs/default/
with iqcjavosca-bundle.pem file.
Close all the UAM applications, then restart the UAM services.
For Linux machines, run the following command: /etc/init.d/uamserver restart.
For Windows computers, go to Services > NetIQ UNIX Agent Manager Server, right click and select Restart.
Re-launch the UAM application.
Repeat this procedure for all UAM instances by appending the UAM certificate file.