Migrating the managed hosts to 2048-bit certificate

Last published : Aug 24, 2026
You need to run the at_migration.pl Perl script on Management Server to migrate the Management Server domain (all the managed hosts reporting to Management Server) to 2048-bit certificate.
In case any managed host is not reporting to Management Server or any managed host fails to migrate when the script is run, you need to manually migrate that particular host by running the script on the host.
Note: All those managed hosts that fail to migrate after running the script, may not be able to communicate with Management server unless they are manually migrated to 2048-bit certificates.
To migrate the managed hosts to 2048-bit certificate
  1. On your Management Server, run the at_migration.pl Perl script.
    • On Linux Management Server:
      /opt/VRTSsfmh/util/at_migration.pl --migrate
      • On Windows Management Server:
      C:\Program Files\Veritas\VRTSsfmh\bin\perl.exe
       "C:\Program Files\Veritas\VRTSsfmh\util\at_migration.pl"
        --migrate
  2. The script displays the following information:
    • Number of managed hosts that have host package version 7.0 or later, and are reporting to Management Server.
    • Number of managed hosts that are not reachable from management Server.
    • Number of managed hosts that have host package version lower than 7.0.
You need to confirm if you want to continue with the migration, or you want to perform the migration only after updating the managed host packages or fixing the communication issue. Enter nto cancel the migration ory to continue with the migration process without fixing any of the above mentioned issues.
  1. Once the migration of eligible managed hosts is complete, verify the list of managed hosts that are not yet migrated to 2048-bit and are still on 1024-bit certificates.
    • On Linux Management Server:
      /opt/VRTSsfmh/util/at_migration.pl --list_1024_hosts
      • On Windows Management Server:
      C:\Program Files\Veritas\VRTSsfmh\bin\perl.exe
       "C:\Program Files\Veritas\VRTSsfmh\util\at_migration.pl"
        --list_1024_hosts
  2. On the managed hosts that are still on 1024-bit, run the at_migration.pl script to manually migrate them to 2048-bit.
    • On Linux/UNIX hosts:
      /opt/VRTSsfmh/util/at_migration.pl --import_credentials
       --xml_filename=Path_to_xml_file
       --cs_hostname=ms_hostname
       --sfm_password=db_password
      • On Windows hosts:
      C:\Program Files\Veritas\VRTSsfmh\bin\perl.exe
       "C:\Program Files\Veritas\VRTSsfmh\util\at_migration.pl"
       --import_credentials
       --xml_filename=Path_to_xml_file
       --cs_hostname=ms_hostname
       --sfm_password=db_password
where,
  • Path_to_xml_file is the path to the xml file that is generated when you run the at_migration.pl script on Management Server. Copy this file to the managed host where you need to run the script to manually migrate the host.
  • ms_hostname is the hostname of Management Server. In case of HA environment, it should be IP address of Management Server.
  • db_password is the encrypted database password of Management Server. Run the following command to get this password:
    • On Linux Management Server:
      /opt/VRTSsfmh/bin/xdbadm
       -g -u habdbsync -c
       /var/opt/VRTSsfmcs/conf
      • On Windows Management Server:
      "C:\Program Files\Veritas\VRTSsfmh\bin\xdbadm.exe"
       -g -u habdbsync -c
       "c:\ProgramData\Symantec\VRTSsfmcs\conf"
Note: Migration to 2048-bit certificates is not supported on a Windows Management Server that is configured in high availability environment.
Related information