Encryption Verification and Demonstration between Components - AutoSys

Products

• Autosys Workload Automation

Issue/Introduction

This article explains how to demonstrate and verify that communication between AutoSys Workload Automation components (Scheduler, Application Server, Agents, and Clients) is encrypted.
It covers standard encryption, the autosys_secure utility, and the HTTPS/TLS feature introduced in version 24.1.

Environment

• Product: AutoSys Workload Automation AE
• Version:  12.x, 24.X
• Component: Scheduler, Application Server, Agent, Client

Cause

Customers often need to provide evidence to security or compliance teams that data in transit between AutoSys components is encrypted.

Resolution

Communication encryption depends on the specific AutoSys components involved:

1. Standard (Non-HTTPS) Communication AutoSys provides built-in encryption that does not require the HTTPS feature.
   
   AE to Agent:
   Encryption is managed via the encryption_type (NONE, DEFAULT, AES) and key_to_agent attributes in the machine definition.
   The agent must have a matching security.cryptkey in the agentparm.txt file.
   
   CLI to Application Server:
   Traffic is encrypted using an instance-wide key stored in cryptkey.txt (within the $AUTOUSER directory), controlled by the UseEncryption setting.
   
   
2. Client Commands and autosys_secure
   autosys_secure is a client Command-line utility.
   Its communication with the application server is protected by the same instance-wide encryption key used for all CLI traffic.
   While autosys_secure manages credentials and certificates, it does not configure the AE-to-Agent transport encryption itself.
   
   
3. HTTPS/TLS Communication (Version 24.1 and higher) For environments using the HTTPS/TLS feature:
   1. All job data and commands are encrypted using TLS with mutual authentication (mTLS).
   2. Configuration is handled via the sslconfig file and certificate properties.
   3. Fixed in release 24.1 and higher. See Download Broadcom Products and Software to download this release.
      
      
4. How to Demonstrate Encryption As there is no built-in "encryption status" command, use the following methods
   1. Configuration Evidence: Verify that encryption_type is set to AES and keys match between the Manager and Agent.
   2. Network-Level Proof: Use openssl s_client against the agent port (e.g., #### or ####) or perform a packet capture (tcpdump/Wireshark) to show the TLS handshake.
      Note: Consult with your network team before performing packet captures.

Additional Information

For defects and enhancements, it is recommended to subscribe to the article to be updated on fix status (Link: Subscribe to a Broadcom knowledge article by article or product).

To speak with a customer representative or a Support Engineer see Contact Support. Scroll to the bottom of the page and click on the respective region.