Failed to fetch signature for policy/ruleset received when trying to deploy a policy after a server rebuild

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

After a server rebuild, clients cannot receive a new version of an existing policy -

In the policyfetcher.log there are the following error messages:

failed to fetch signature for policy "NAME#14"
failed to fetch signature for ruleset "NAME#14"

However, all policies and rulesets are finalized in the DMS

Environment

CA PAM 14.X and CA PIM 12.8.X and other versions

Cause

This may be caused by lack of synchronization between the DH and the DMS.

If the policy  in the DMS is OK and finalized, but in the DH it is empty or incomplete at the DH (for instance  the ruleset and policy are defined, but the ruleset has no rules and therefore it cannot be finalized, then the policy at the DH cannot be finalized either)

This may happen for instance if the data added in the GUI is correctly reflected at the DMS but it does not make it to the DH

Resolution

dmsmgr -sync -self may help

Eventually it should be checked why the policy is not synchronized between DMS and DH as it may be an indication of corruption or problems.