Solution to Licensing Problems with Cloud License Service (CLS)

Issue Description: 

• Customers are having licensing problems with Cloud License Service (CLS).

Cause: 

• Your OS Trusted Root Certificate Authorities have not been updated.

Why You Need to Install a New Certificate:

• This is an ongoing effort to ensure your systems are secured.
• A good background article can be found here: DigiCert: Expiring public root and intermediate CA certificates

Resolution:

• You need to install the new certificate ("Amazon Root CA 1-4") on your OS. 
• If you need any help on updating your certificate, please raise a support case at https://anyware.hp.com.

Is Updating Your Operating System not an Option?

• Amazon CA Root 1-4 are in fact part of the Microsoft Trusted Root Program: https://aws.amazon.com/blogs/security/how-to-prepare-for-aws-move-to-its-own-certificate-authority/
• Therefore, updating your operating systems (Windows, Linux, macOS) is the quickest way to update your OS' Trusted Root Authorities Store and resolve this issue.

We only recommend to manually install the root CA as in the following, if updating your OS is not an option or it does not fix the issue.

Windows

Option-1 Install the certificate using Windows GUI:

1. In the Certificate window, click Install Certificate
2. Choose Local Machine (for all users) or Current User (just for yourself) and click Next
3. Select Automatically select store based on the certificate type and click Next, then Finish
4. Click OK to confirm the installation
5. Go to Start Menu -> "Manage Computer Certificates", ensure that the Amazon Root CA 1-4 are installed as in the following screenshot.

Option-2 Command-line installation:

• NOTE: this would install all latest certificates for Windows OS to your certificate store - consult your IT administrator as this requires admin privilege.

1. Open Command Prompt with an elevation (admin) privilege
2. Run: "certutil.exe -generateSSTFromWU roots.sst"
3. Run: "certutil.exe -addstore root roots.sst"
4. Go to Start Menu -> "Manage Computer Certificates", ensure that the Amazon Root CA 1-4 is installed as in the above screenshot

Note: if after installing, the cert is not in the above folder, you can manually move the crt file to the above folder.

Linux - RHEL/Rocky

1. Download the Amazon Root CA: amz-all-compliance.flexnetoperations.com.crt 
2. Move the downloaded CA file to /etc/pki/ca-trust/source/anchors/
3. sudo update-ca-trust
4. Run the following to ensure /etc/ssl/certs has the Amazon_Root_CA_*.pem (1-4):
   • openssl x509 -in /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem -text -noout 

Linux - Ubuntu

1. sudo apt install ca-certificates
2. sudo update-ca-certificates
3. Run the following to ensure /etc/ssl/certs has the Amazon_Root_CA_*.pem (1-4): 
   • ls -lha /etc/ssl/certs | grep Amazon_Root_CA

macOS

• Install the latest OS updates from Apple.