REST with sslenabled throws error U00045393 SSL Certificate invalid: The validity period of the certificate has expired or not yet reached.

Products

• CA Automic Workload Automation - Automation Engine
• CA Automic One Automation

Issue/Introduction

When attempting to start a REST API Process on 21.0 or 24.X with sslenabled=1, the REST process will not start.  The log shows the following error:

20240906/105724.734 - 30     U00003400 Server 'REST API' version '21.0.9+build.1701703623620' (changelist '1701703623') started.
...
20240906/105816.041 - 40     U00003471 The Server 'AUTOMIC#CP005' has successfully been initialized, *** R E A D Y   F O R   R U N ***
20240906/105816.056 - 40     U00003368 Cold start initiated by Server 'AUTOMIC#WP001'.
20240906/105817.072 - 37               Not tracking HTTP performance metrics
20240906/105817.119 - 37               Jetty: Logging initialized @55329ms to com.automic.rest.server.JettyLogBridge
20240906/105817.134 - 37     U00045393 SSL Certificate invalid: The validity period of the certificate has expired or not yet reached.
...
20240906/105822.214 - 53     U00003124 ListenSocket with port number '[0:0:0:0:0:0:0:0]:2317' has been closed.
20240906/105822.214 - 53     U00003410 Server 'AUTOMIC#CP005' version '21.0.9+build.1701703623620' ended abnormally.

Environment

Automic version: 21.0 or 24.X

Resolution

Check the logs for the following things:

What keystore is being used?
     keystore=C:\Automic\AutomationEngine\bin\keystore.p12
Run the keytool against this to see what is in the keystore SAN certificate:
     keytool -v -list -keystore C:\Automic\AutomationEngine\keystore.p12
Check what's listed in the SAN from the output of the above command and look for:
     SubjectAlternativeName [
       DNSName: SERVERNAME01
       DNSName: SERVERNAME02
       DNSName: servername01.example.com
       DNSName: servername02.example.com
       IPAddress: 10.0.0.0
       IPAddress: 10.0.0.1
     ]

Now check what the REST process shows itself as in the log file:

20240906/105725.625 - 30               Server            Type C Host                      Port           StartTime      LastUpdateTime
20240906/105725.625 - 30               ----------------  ---- - -----------------------  ----- ------------------- -------------------
...
20240906/105725.625 - 30               AUTOMIC#CP005    REST * servername01              2317 2024-09-06 15:57:24 2024-09-06 15:57:25 

 

In the case above, note that SAN shows all uppercase for SERVERNAME01 while the REST process log shows as lowercase servername01.  These need to match, case included.  The best practices we would suggest would be:

1. Only use lowercase in the keystore
2. "force" the process to show itself as a lower case and/or fully qualified domain name by using the hostname= parameter in the ucsrv.ini file.  For example, to cause the REST process to show its host as servernam01.example.com, you would use the following:
   hostname=servername01.example.com

This way the REST process always starts as something set explicitly that matches the keystore and by having everything be lowercase, there will be no confusion with some lowercase and some uppercase, or mixed case servernames.