HTTPS configured Data Aggregator fails to start due to Keystore Alias or Multiple Private Key Entries

Products

• Network Observability

Issue/Introduction

After upgrading DX NetOps Performance Management to version 25.4.4 or later, the Data Aggregator (DA) starts, but the web services (ports 8581/8582) are not listening. The following errors may appear in /opt/CA/IMDataAggregator/data/log/netops-data-aggregator.log:

• java.io.IOException: Alias name [sscada] does not identify a key entry
• java.lang.IllegalArgumentException: KeyStores with multiple certificates are not supported

Environment

DX NetOps Performance Management.

Cause

The DA startup process requires a specific alias (sscada) for the SSL certificate. This issue occurs if:

1. The alias is named incorrectly (e.g., cada and the keystore contains more than one PrivateKeyEntry, which prevents the automatic sslConfig.sh script from identifying the correct key.

Resolution

1. Log in to the Data Aggregator host as the root or install user.
2. Navigate to the SSL directory: cd /opt/CA/IMDataAggregator/config/ssl/
3. Make a backup copy of the keystore: cp keystore keystore.bak
4. List the current keystore entries: /opt/CA/IMDataAggregator/jre/bin/keytool -list -keystore keystore
5. If multiple PrivateKeyEntry items exist, delete the unused or incorrect entries: /opt/CA/IMDataAggregator/jre/bin/keytool -delete -alias <incorrect_alias> -keystore keystore
6. If the correct key has an incorrect alias (e.g., cada), rename it to sscada: /opt/CA/IMDataAggregator/jre/bin/keytool -changealias -keystore keystore -alias cada -destalias sscada
7. Verify the change by listing the keystore again. It should now show a single PrivateKeyEntry with the alias sscada.
8. Restart the Data Aggregator service: systemctl stop dadaemon systemctl start dadaemon