Jobs Fail with SSLHandshakeException when Testing with Future-Dated System Clock.

Products

• Automic Automation

Issue/Introduction

Jobs Fail with SSLHandshakeException when Testing with Future-Dated System Clock.

When executing jobs that perform HTTPS requests to external APIs (e.g., Microsoft OAuth, Azure services, or other third-party endpoints), the system performs a standard TLS/SSL handshake.

If the server running the agent or the Automic system has its clock set to a future date for testing purposes, the TLS handshake will fail.

Environment

AE 24.4.3

Cause

The JVM, responsible for the SSL connection, will attempt to validate the third-party endpoint's SSL certificate against the current system time. Since the system time is set to the future, the certificate validation logic rejects the connection because it perceives the certificate as expired or not yet valid relative to the testing date.

Common Error: javax.net.ssl.SSLHandshakeException: (certificate_expired) PKIX path validation failed: java.security.cert.CertPathValidatorException: validity check failed

Resolution

This behavior is a standard security feature of TLS/SSL protocols and is not a defect within the Automic Automation product.

To resolve or prevent this issue during future-dated testing:

Avoid using future-dated system clocks for live endpoints: Do not use a system clock that deviates from real-time when interacting with live, third-party HTTPS endpoints. These endpoints enforce strict time-based certificate validation that will fail if your system time does not match the current real-world time.

Use isolated test environments: If your testing requirements necessitate future-dated scenarios, point these jobs to a temporary, isolated test service or a mock server. Ensure that this test service is configured with your own certificate that is valid for the duration of your intended test window, rather than relying on real, public-facing production endpoints.

Verify Protocol Requirements: Jobs that utilize plain HTTP (and do not require TLS/SSL handshakes) are not affected by certificate validation and will continue to function. If a job is failing, confirm if it is performing an HTTPS handshake as part of its authentication or request process.