2.4 Active-Active OCLM Deployment

DSR/SDS supports an Active-Active OCLM deployment by configuring two active OCLM nodes in the DSR/SDS GUI. In this model, both OCLM nodes are available for certificate lifecycle requests, and both OCLM nodes can communicate with Operator CA.

The two OCLM nodes are deployed and managed as independent active nodes. DSR/SDS is responsible for using the configured OCLM nodes. OCLM does not provide node-to-node clustering or automatic synchronization between the nodes.

For an Active-Active OCLM pair, ensure the following for both OCLM nodes:

• The OCLM VM is deployed and reachable from DSR/SDS on TCP 8989.
• Operator CA CMP configuration is completed in /opt/oclm-service/issuerConfig.properties.
• Operator CA trust files are installed in the /opt/oclm-service.
• Initial CMP client certificate and key are installed in the /opt/oclm-service/certs.
• The OCLM service is running and listening on TCP 8989.
• OCLM can reach the Operator CA CMP endpoint.
• Operator CA trusts the CMP client identity used by the OCLM node according to the customer PKI policy.