ITPAM startup fails if c2okeystore is removed

Products

• CA Process Automation Base

Issue/Introduction

When attempting to address security vulnerabilities related to the 1024-bit RSA key in the default c2okeystore file, users may try to remove or rename the file, especially if they have already configured a custom 2048-bit or 4096-bit certificate for the Web UI.

However, after removing or renaming PAM\wildfly\standalone\.config\c2okeystore, IT Process Automation (ITPAM) fails to start.

The c2o.log or console output displays errors such as: Failed to decrypt data java.io.FileNotFoundException: PAM\wildfly\standalone\.config\c2okeystore (The system cannot find the file specified)

Environment

Product: CA IT Process Automation (ITPAM)

Version: 4.4 CP04 and earlier

Cause

By design, the c2okeystore file is required for the ITPAM server startup process to decrypt critical data, including database passwords. This dependency exists even if a custom certificate has been successfully configured for Web UI access and internal communication in the OasisConfig.properties file.

Resolution

1. Retain the c2okeystore File

Do not remove or rename the c2okeystore file. It must remain in the .config directory for the server to successfully initialize and decrypt its internal configurations.

2. Future Enhancements

Increasing the default key size of the c2okeystore file is currently considered an enhancement request. Users are encouraged to vote for or follow related idea on the Broadcom Community portal.

Additional Information

Configure Custom SSL Certificates and Passwords for PAM/Wildfly

Updating certificates of the internal communication ports of ITPAM