Password encryption limitation in Tomcat server․xml for AutoSys

Products

• Autosys Workload Automation

Issue/Introduction

You need to encrypt the SSL certificate keystore password within the Tomcat server․xml file for AutoSys Workload Automation․​​​​​‌​‍

ERROR MESSAGE: "None"

SYMPTOMS:

• The certificateKeystorePassword value is exposed in plain text in the server․xml file

• You are using a BCFKS certificate

CONTEXT: This occurs when configuring SSL certificates in the bundled web server configuration file

IMPACT: Security compliance vulnerability due to plain-text passwords

Environment

AutoSys 12.x, 24,x
Tomcat 9.X, 11.X

Cause

The limitation originates from the upstream Apache Tomcat project, which does not provide native server․xml password encryption out-of-the-box ․

Resolution

EXPECTED:
The server․xml file is a configuration file for the bundled Apache Tomcat server shipped with the product ․
The code that utilizes this configuration comes directly from Tomcat and not the development team ․

2․ VERIFY TOMCAT CAPABILITIES

EXPECTED:
Currently, Tomcat 9․x and Tomcat 11․x do not have a native, out-of-the-box encryption command specifically for the server․xml file ․