Usage of certificate cspmclient_thirdparty/jetty/etc/jettydemo.p12 in A2A client version 3.4.6

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

In versions 3.4.6 of the CA PAM A2A client there is a jetty folder under cspmclient_thirdparty

That folder contains a certificate: cspmclient_thirdparty/jetty/etc/jettydemo.p12 

For compliance purposes some clients would like to know if this certificate may be deleted and if it is used for any operation by the A2A client

Environment

CA PAM A2A version 3.4.6

Resolution

The Jetty version in the A2A client 3.4.6 is 5.1.15. This  is a very old version released in 2009.

The jettydemo.p12 certificate is  a demo certificate that comes with Jetty. That demo certificate is not used in any of the Jetty configuration files in the etc directory under the A2A 3.4.6 client. 

Jetty  was upgraded in A2A from 5.1.15 (PAM 3.4.6) to 9.4.44 (PAM 4.0.2 and 4.1).

After upgrading to Jetty 9.4.44 in PAM 4.0.2 and 4.1, the obsolete cspmclient_thirdparty/jetty no longer needed and does not exist anymore.

The cspmclient/lib/jetty-all-9.4.44.v20210927-uber.jar is the one currently in use.

So the jettydemo.p12 certificate may be safely ignored or removed.