Impact of changing the default Java/JRE cacerts keystore password on AutoSys, Agents, and WCC

Products

• Autosys Workload Automation

Issue/Introduction

Users often look to change the default JRE cacerts keystore password (changeit) for security compliance. This case addresses the potential impact of changing this default password to a custom password for the following components:

• AutoSys Workload Automation Engine/WebServer
• Agents (System Agent)
• WCC (Web UI)
• Embedded Entitlements Manager (EEM)

Resolution

Changing the default JRE cacerts password has no impact on most components. Below is the breakdown and required configuration steps:

1. AutoSys Engine, WCC, and AEWS:

   • There is no impact. These components do not rely on the default JRE truststore password.
   • Note on WCC: The file javakeystore.properties (often located in data/config/) is a legacy configuration file and is not used in modern WCC versions. It can be safely ignored; no changes are required here.

2. EEM:

   • There is no impact on EEM components when changing the JRE cacerts password.

3. System Agent:

   • Impact: If the Agent is configured for HTTP (or similar) jobs, it creates a truststore dynamically using a copy of the JRE's cacerts. Changing the password without updating the configuration will cause the agent to fail when attempting HTTPS connections.
   • Symptoms of misconfiguration: Below errors are seen in the agent's logs:  
     • java.io.IOException: Keystore was tampered with, or password was incorrect
     • java.lang.SecurityException: Error constructing trust manager
   • Required Configuration Change: Update the agentparm.txt file with the following parameters:
     • https.client.ssl.truststore=/opt/CA/WorkloadAutomationAE/SystemAgent/WA_AGENT/cacerts
     • https.client.ssl.truststore.password=######### (Note: The password must be encrypted using the <AGENT>/password tool with the AES 128-bit option.)