34.2 Changing the DNS Name or the IP Address and DNS Name of a Primary Server after Installing ZENworks 11

If you want to change only the DNS name or if you want to change both the IP address and DNS name of the Primary Server after installing ZENworks 11, and if the certificate’s CN has fully qualified DNS configured, use the following steps to change only the DNS name or to change both the IP address and DNS name of the Primary Server:

NOTE:This scenario has been tested only on the Windows Primary Server and the embedded Sybase database. In this setup, the DNS and DHCP servers are configured on the same device.

This scenario is supported only in a zone that is configured with external certificate.

Take a reliable backup of the following on all the Primary Servers in the Management Zone:
- Content-Repo Directory: The content-repo directory is located by default in the ZENworks_installation_directory\work directory on Windows and in the /var/opt/novell/zenworks/ on Linux.
  
  Ensure that the images directory located within the content-repo directory has been successfully backed up.
- Certificate Authority: For detailed information on how to back up the certificate authority, see Section 32.3, Backing Up the Certificate Authority.
- Embedded Database: For detailed information on how to back up the embedded database, see Section 29.3, Backing Up the Embedded Sybase SQL Anywhere Database.
Create a certificate signing request (CSR) by providing the hostname of the Primary Server as the subject.

For more information on how to create a CSR, see Creating an External Certificate in the ZENworks 11 Server Installation Guide.
At the console prompt of a Primary Server, run the following command:

zman sacert Path_of_the_Primary_Server_in_ZENworks_Control_Center Path_of_Primary_Server_Certificate

For more information about zman, view the zman man page (man zman) on the device or see the ZENworks 11 Command Line Utilities Reference.

This adds the certificate of the Primary Server that you specified in the command to the ZENworks database and certificate store.

NOTE:You must run the command for each device whose certificate you want to replace.
Refresh all the devices, including the Primary Servers, in the zone.

The Primary Server certificates that were imported in Step 3 are sent to the devices as configuration data.
Import the root certificate of the new certificate authority into the trusted store on all the devices in the zone through the zac cert-info command. You can choose to execute the command in one of the following ways:
- Manually run the following command on each Primary Server and managed device in the zone:
  
  zac cert-info certificate_file_path -u zone_administrator_username -p zone_administrator_password
  
  For more information about zac, view the zac man page (man zac) on the device or see the ZENworks 11 Command Line Utilities Reference.
- Use a ZENworks bundle.
  
  For more information about bundles, see Creating Bundles in the ZENworks 11 Software Distribution Reference.
Enforce the new certificates on the zone by running the following command on any Primary Server whose DNS name is changed:

novell-zenworks-configure -c SSL -Z

Follow the prompts. Do not remint the Certificate authority, just the server certificate.
Restart all the ZENworks services on all the Primary Servers in the zone by running the following command at the console prompt of each Primary Server in the zone:

novell-zenworks-configure -c Start

By default, all the services are selected. You must select Restart as the Action.
Refresh all the devices, including the Primary Servers, in the zone.

If any device is not reachable during the refresh, you must first establish a connection with the device, then run the following command at the console prompt of each device to reestablish the trust between the device and the zone:

zac retr -u zone_administrator_username -p zone_administrator_password
Re-create all the default and custom deployment packages for all the Primary Servers:
- Default Deployment Packages: At the console prompt of each Primary Server in the zone, enter the following command:
  
  novell-zenworks-configure -c CreateExtractorPacks -Z
- Custom Deployment Packages: At the console prompt of each Primary Server in the zone, enter the following command:
  
  novell-zenworks- configure -c RebuildCustomPacks -Z
Configure the Satellites with the new external certificates by entering the following command at the console prompt of each Satellite in the zone:

zac iac -pk private-key.der -c signed-server_certificate.der -ca signing-authority-public-certificate.der -ks keystore.jks -ksp keystore-pass-phrase -a signed-cert-alias -ks signed-cert-passphrase -u username -p password -rc

For more information about zac, view the zac man page (man zac) on the device or see the ZENworks 11 Command Line Utilities Reference.
(Conditional) If your zone includes Intel AMT devices, unprovision and provision the devices.

For more information about unprovisioning and provisioning Intel AMT devices, see Configuring Intel AMT Devices in Enterprise Mode in the ZENworks 11 Out-of-Band Management Reference.