Error: Connection to the AE system not possible after certificate update

Products

• CA Automic Workload Automation - Automation Engine
• CA Automic One Automation

Issue/Introduction

After updating SSL/TLS certificates on the Automation Engine (AE) servers, users cannot connect via the Automic Web Interface (AWI). The following error appears during login:

Connection to the AE system not possible. No connection to the following CPs could be established: [server:port]

This issue often occurs in environments with multiple AE Servers after a certificate or keystore update.

Environment

• Automic Automation 21.x and higher
• Multiple Automation Engine Servers
• TLS/SSL enabled

 

Cause

The AWI cannot establish a trusted connection to the Communication Processes (CPs) or REST endpoints because the new certificates are not trusted by the AWI host, or the REST process has not refreshed its SSL context.

Resolution

1. Update the trusted certificate folder:

   • Verify the trustedCertFolder= setting in the AWI uc4config.xml file.
   • Ensure this directory contains the updated root and intermediate certificates from the AE Server's new certificate chain.

2. Import certificates into Java Keystore:

   • Export the new certificate from the AE keystore.
   • Import the certificate into the Java cacerts keystore used by the application server (Tomcat or Jetty) hosting the AWI.

3. Restart REST processes:

   • Manually restart the REST process(es) in the Administration perspective. The REST process initializes the SSL context at startup and does not automatically detect keystore changes.

4. Verify Hostname matching:

   • Confirm that the hostname= in the [TCP/IP] and [REST] sections of the ucsrv.ini file matches the Common Name (CN) or Subject Alternative Name (SAN) of the new certificate.

5. Restart Services:

   • Restart the JCP and REST processes on all AE servers.
   • Restart the AWI application server.