Provisioning a separate BigFix Instance (two instances concurrently)

[manny]

I’ve obtained a “LicenseAuthorization.BESLicenseAuthorization” from the IBM BigFix License Key Center. I was careful to allocate quantities accordingly to ensure that i didn’t exceed our license allocation.

I chose the option “I want to install with an IBM BigFix license authorization file”, but I am getting an “Invalid License Certificate error: The license certificate you have selected does not match your private key”.

My ultimate goal is to provision an additional instance for development.

[AlanM]

First, you can only use a license authorization once. It will not install two servers.

Second, the private key generated for the first install is incredibly important (so make sure you keep it around) and has to be unique so if you are trying to install two deployments with a single license then I suggest you talk to your sales contact about getting a test install or something else that would allow you to do this.

[manny]

AlanM,

The license authorization file that i’ve obtained is NOT the same one used for the original installation. It is a separate and newly generated file with a new and different serial number.

The private key generated for the first install is safe and around.

But if I am understanding you correctly, in order to deploy TWO BigFix instances, we need TWO separate licenses.

[AlanM]

Yes, you need a license per deployment.

[manny]

Understood. Thanks for you help.

[manny]

AlanM,

If you don’t mind, could you please explain what purpose does the ability to generate multiple authorization files serve? The process allows one to segment “available quantities” of products (i.e. Lifecycle management, security and compliance, etc).

I hope you can see why i was trying to get that to work. I understood this to be a function for exactly that purpose: running two separate instances.

[AlanM]

Maybe I misunderstood then. If you are able through some portal (sorry I don’t see the customer facing elements) to make multiple licenses (multiple auth files) then you do have the right thing. I would suggest filing a PMR then to get help as it should work fine

[manny]

AlanM,

The IBM BigFix License Key Center (https://tem.subscribenet.com/control/ibmt/temLicenses) does allow us to create a new license:

“Choose the serial number you want to modify or select New Serial Number if you want to create a new license in addition to your existing license(s).”

But that does not generate a new license. Instead it creates an additional “LicenseAuthorization.BESLicenseAuthorization” but the use of this file results in the error I’ve described.

I am new to this, so I need to learn how to file a PMR; but I will take care of it tomorrow morning.

[AlanM]

Please see How to ask for IBM product help: PMRs, RFEs, and more

[JasonWalker]

Are you installing your root server on Windows or Linux? Could you provide some screen shots of the first couple of steps of your installation getting you to this point?

Very early in the installation you have a choice of “Installing an evaluation”, “Installing using a license authorization file”, or “Installing using an existing masthead and key file”.

If you’ve just received a new authorization file from Subscribenet, then you have not yet created a site signing certificate and private key. You’d select the second option to install using a license authorization file, and the installer will prompt you to create a new certificate and password for the private key file. At no point there should you select the certificate or private key file from your first deployment.

I think the message you are seeing implies that either you’ve taken the “Install using an existing masthead file” option, or, when prompted to create a new certificate and PVK you directed the installer to your existing files and it failed to warn you about that.

Or it could be some other condition I’m not aware of, in which case I’d echo Alan’s advice to contact support.

[manny]

JasonWalker,

Thank you for your input. What I am trying to do is not allowed. I need a separate license for each individual deployment. I tried contacting IBM (i.e. PMR) and they pointed me towards "tem@dk.ibm.com" but they don’t understand my question.

[What am I trying to do?]

We have had a functional BigFix instance since 2016. The license has an allocation of 6K. I would like to split that into two licenses so that I can run two separate BigFix instances (e.g. 1K & 5K). I assumed that the ability to create new authorization files (and to disperse allocations across them) in the IBM BigFix License Key Center (https://tem.subscribenet.com/control/ibmt/temLicenses) would permit me to provision separate instances; but that is not the intended purpose.

[steve]

You are doing the right thing. The LicenseAuthorization file is used to generate your license at install time. So as long as you had two auth files, and used each one for a separate install, then it should have worked. The resulting license.crt, license.pvk, and masthead.afxm are also distinct, and can only be used for the deployments they were generated with.

It sounds to me like there was an issue generating the license during the second install. So you probably need to create a new LicenseAuthorization file and try again. Make sure you remove any of the prior attempts remnants, so you don’t mix up licenses when you generate the new ones. You should be able to deallocate licenses from the first auth file you generated in the license portal.

[manny]

Steve,

I have exchanged a dozen emails with "tem@dk.ibm.com" and they do not understand what I am trying to do.

I have the ability to deallocate licenses within “(https://tem.subscribenet.com/control/ibmt/temLicenses)” and even instantiate a “LicenseAuthorization.BESLicenseAuthorization”. But that auth file has not worked; it consistently generates an “Invalid License Certificate error: The license certificate you have selected does not match your private key”.

I cannot get a straight answer from "tem@dk.ibm.com" on whether or not this is possible. You are the first person to confidently confirm that it is possible. So I am going to move forward confidently that the following is possible:

“We currently have a license with six thousand allocations. With that license, we have successfully provisioned a BigFix instance and have successfully been using it since 2016. I DO NOT want to change that instance. Instead, I would like to split our license into two licenses: One new license with 1000 allocations and leave 5000 allocations in the existing license. I then would like to use the new “1000 allocation license” to provision a new, separate and independent BigFix instance.”

[steve]

Yes, that is possible. Once a LicenseAuth file fails, it won’t work anymore, so the error won’t change if you keep retrying. You have to generate a new auth file, in order to try again.

[manny]

Steve,

I can no longer generate a “LicenseAuthorization.BESLicenseAuthorization” from “https://tem.subscribenet.com/control/ibmt/temLicenses”; Instead, I can only generate a “LicenseAuthorization.crt.txt”.

I have reached-out to "tem@dk.ibm.com" and I am waiting for them to restore my ability to generate a LicenseAuthFiles.

[manny]

All,

We are all set.

We just received a new “LicenseAuthorization.BESLicenseAuthorization” from "tem@dk.ibm.com" and this time around, the install was uneventful.

Thank you AlanM, JasonWalker, and Steve.