ServiceNow Ticket validation not working after upgrade to PAM 4.1.0

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

ServiceNow Ticket validation is not working after the upgrade from 3.4.5 to 4.1.0. The failure is very quick and there is no record on the ServiceNow side that PAM tried to validate the ticket ID provided.

Environment

Privileged Access Manager 4.1.0-4.1.2

Cause

The connection fails during server certificate validation. Depending on other configurations and activities, it was possible that PAM would use an internal key/certificate store, which is meant for use by a few target applications for password management only, for validation of the ServiceNow server certificate. The internal key store does not need and therefore does not contain common root certificates such as the Entrust root certificate that is at the root of the ServiceNow certificate chain. The internal key store will cause validation failures on good certificates if used in the wrong context. The NIM versions included in the latest PAM releases use a different method to establish secure HTTPS connections, which exposed this problem.

Resolution

This problem was resolved as DE548256 in the 4.1.3 release.

Additional Information

Resolved Issues in 4.1.3: https://techdocs.broadcom.com/us/en/symantec-security-software/identity-security/privileged-access-manager/4-1-5/release-information/resolved-issues-in-earlier-4-x-releases/Resolved-Issues-in-4-1-3.html