Identity Manager SSL Certificate Import Error WFLYDM0084 Alias Not a Key

Products

• CA Identity Manager
• CA Identity Suite

Issue/Introduction

When importing an externally signed SSL certificate into Symantec Identity Manager (IM) running on a JBoss/Wildfly application server, the import process may fail if the keystore does not contain the required private key associated with the certificate.

The application server logs or console display the following error during the certificate import process:

WFLYDM0084: The alias specified 'appserver2' is not a Key, valid aliases are {deviam}

Environment

Identity Manager 14.x

Cause

This error occurs because the Identity Manager application requires both the public and private keys to be present in the SSL certificate keystore. If only the public certificate is imported without its corresponding private key, JBoss cannot validate the alias as a valid key entry.

Resolution

To resolve this issue, ensure the certificate and its full private key pair are correctly imported into the application keystore:

1. Verify Certificate Format: Ensure the external certificate is provided in a format that includes the private key (such as a .p12 or .pfx file).
2. Import Private Key: Import the private key into the keystore used by the application server. The alias used during the import must match the alias expected by the JBoss configuration.
3. Validate Keystore Content: Run the keytool -list command to verify that the entry for your alias is listed as a PrivateKeyEntry and not just a trustedCertEntry.
   • Example command: keytool -list -v -keystore your_keystore.jks
4. Restart Services: After updating the keystore, restart the Identity Manager application server to apply the SSL changes.

Additional Information

Identity Manager requires the complete key pair (Public and Private) for the SSL handshake to function correctly on the Wildfly platform.