Unable to log into CA PIM webinterface

Products

• CA Privileged Identity Management Endpoint (PIM)

Issue/Introduction

Suddenly it is no longer possible to login to CA PIM 12.X  web interface.

Tryint to connect to https://<entm_server>:18443/iam7ac returns with a page not found, and trying to access https://<entm_server>:184437idmmanage returns a null error and no information about ac_env or ac_dir

Server.log is full of errors like the following

2021-07-09 13:10:47,775 DEBUG [org.jboss.mq.pm.jdbc2.MSSQLPersistenceManager] Connection attempt # 3 failed with SQLException
org.jboss.util.NestedSQLException: Could not create connection; - nested throwable: (com.microsoft.sqlserver.jdbc.SQLServerException: The driver could not establish a secure connection to SQL Server by using Secure Sockets Layer (SSL) encryption. Error: "SQL Server did not return a response. The connection has been closed. ClientConnectionId:f9cc05ee-f066-40bc-a8fd-c85e8341602c".); - nested throwable: (org.jboss.resource.JBossResourceException: Could not create connection; - nested throwable: (com.microsoft.sqlserver.jdbc.SQLServerException: The driver could not establish a secure connection to SQL Server by using Secure Sockets Layer (SSL) encryption. Error: "SQL Server did not return a response. The connection has been closed. ClientConnectionId:f9cc05ee-f066-40bc-a8fd-c85e8341602c".))

and of course nothing is loaded in server.log following these messages

Environment

Release : 12.8

Component : CA ControlMinder - Unix

Cause

This may occur if the security settings at the SQL sever acting as RDBMS have been changed to exclude TLS v 1.1, which is a common practice.

See for instance:

https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/disable-tls-1-1dot1-mbam-servers

This change will take effect when the RDBMS server is restarted

JBOSS requires TLS 1.1 for operation, unless it has been modified to use the more secure protocols

 

Resolution

Revert back the TLS change at the SQL RDBMS server and reboot jboss