Centralized Agent Upgrade (CAU) Unintended Downgrade Causes Security Key Mismatch.
Article ID: 454629
Updated On:
Products
Issue/Introduction
Explains that an incorrectly configured CAU package/store assignment can trigger an unintended downgrade of the agent. This downgrade can lead to javax.crypto.BadPaddingException when the older agent binary attempts to use a security key generated by a newer agent version.
Environment
Product: CA Automic Workload Automation - Automation Engine.
Component: Automic Windows Agent.
Operating System: Windows.
Versions: Configurations involving agents moving between modern versions (e.g., 24.4.4+hf.2) and older legacy builds (e.g., 21.0.14).
Cause
The decryption error is triggered by an unintended version downgrade executed via the CAU store.
If a CAU store is configured with a stale package (e.g., v21.0.14), it pushes older binaries and overwrites the newer agent's files.
Newer agent releases write private keys using a modern PKCS#8 format (PBES2), whereas older v21 binaries utilize a legacy PKCS#1 format (AES-256-CBC).
Upon restarting, the older binary's crypto code is incompatible with the PKCS#8 key format written by the newer version, resulting in the padding exception.
Resolution
The root cause is currently under investigation by L2 Engineering. The issue has been logged for engineering review under defect number DE211523.
- Workaround: Delete and recreate the agent's security folder anew.
Upon the next restart, the agent detects the missing key material, generates a brand-new private key in a legacy format it understands, requests a fresh certificate from the server, and successfully reconnects.
Additional Information
Subscribe to this article for future updates on the status of the fix, as described here: .
Feedback
