Recovering from the December 10, 2013 automatic renewal of default certificates

Transcription

1 IBM Tivoli Workload Scheduler Recovering from the December 10, 2013 automatic renewal of default certificates Version

2

3 IBM Tivoli Workload Scheduler Recovering from the December 10, 2013 automatic renewal of default certificates Version

4 Note Before using this information and the product it supports, read the information in Notices on page 11. This edition applies to version 8, release 6, modification level 0 Fix Pack 2 of Tivoli Workload Scheduler (program number 5698-WSH) and to all subsequent releases and modifications until otherwise indicated in new editions. Copyright IBM Corporation 2001, US Government Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

5 Contents Tivoli Workload Scheduler components that are affected by default certificate automatic renewal Error messages in the SystemOut.log file How to restore the default certificates for components with embedded WebSphere Application Server installed on distributed platforms Notices Trademarks Copyright IBM Corp. 2001, 2013 iii

6 iv Recovering from the December 10, 2013 automatic renewal of default certificates

7 Tivoli Workload Scheduler components that are affected by default certificate automatic renewal Problem and cause: Tivoli Workload Scheduler provides a secure, authenticated, and encrypted connection mechanism for communication based on the Secure Sockets Layer (SSL) protocol, which is automatically installed with Tivoli Workload Scheduler. Tivoli Workload Scheduler also provides default certificates to manage the SSL protocol that is based on a private and public key methodology. If you do not customize SSL communication with your own certificates, Tivoli Workload Scheduler uses the default certificates that are stored in the default directories to communicate in SSL mode. The default certificates that were released with Tivoli Workload Scheduler V8.4.0, V8.5.0, V8.5.1, and V8.6.0 general availability expire on February 10, 2014, but you must renew them before December 10, 2013, due to the embedded WebSphere Application Server automatic renewing mechanism that generates new random certificates to use two months before the expiration date. Note: The embedded WebSphere Application Server that were released with Tivoli Workload Scheduler V8.3.0 components does not have the automatic renewing mechanism set. If you do not apply the procedure to renew the Tivoli Workload Scheduler default certificates before December 10, 2013, WebSphere Application Server automatically re-creates and substitutes them for the following Tivoli Workload Scheduler components that embed WebSphere Application Server: v Master domain manager and its backup v Dynamic Workload Console v Distributed connector installed with an agent v Dynamic domain manager and its backups v z/os connector on distributed platforms After the certificate substitution, your Tivoli Workload Scheduler components no longer communicate among themselves. For more information about error messages in the SystemOut.log file, see Error messages in the SystemOut.log file on page 3. The z/os connector on WebSphere Application Server for z/os is not affected by the automatic renewing mechanism because the z/os system security settings does not allow the certificate substitution, however the z/os connector on WebSphere Application Server for z/os is unable to connect to the Dynamic Workload Console because of the automatic renewing mechanism that takes place on the Dynamic Workload Console. During the recovery phase you can only monitor your Tivoli Workload Scheduler environment by using commands lines (if CLISSLAUTHSRV is set to no in Copyright IBM Corp. 2001,

8 thelocalopts file) or by using ISPF panels. The operators are unable to connect from the Dynamic Workload Console or the Job Scheduling Console to Tivoli Workload Scheduler. Furthermore, all the dynamic agents are unable to connect to the master domain manager or its backups or to the dynamic domain managers or their backups and the master domain manager is unable to connect to the dynamic domain managers or their backups. If you have an SSL connection that uses default certificates in a custom integration based on Tivoli Workload Scheduler Java APIs or on the Integration Workbench, the communication does not work after the default certificate expiration date. Solution To restore the communication, you must apply a recovery procedure that first disables the embedded WebSphere Application Server mechanism that generates random certificates and then restores the old default certificates that expire on February 10, 2014: Tivoli Workload Scheduler components with embedded WebSphere Application Server installed on distributed platforms: Apply to the following components, in no specific order, the procedure How to restore the default certificates for components with embedded WebSphere Application Server installed on distributed platforms on page 6: v Master domain manager and its backup v Dynamic Workload Console v Distributed connector installed with an agent v Dynamic domain manager and its backups v z/os connector installed on distributed platforms Note: If you have an integrated installation of the Dynamic Workload Console and Tivoli Workload Scheduler with the same embedded WebSphere Application Server, you need to perform the procedure only one time. Note: z/os connector on WebSphere Application Server for z/os does not have a recovery procedure that you can apply because is not affected by the automatic renewing mechanism. Instead you must perform recovery actions on the components to which it is connected to as Dynamic Workload Console and, apply as soon as possible the renewing certificate procedure, as described in the Readme "Activating the new default security certificates" at docview.wss?uid=swg To do next After completing the recovery procedure, you can apply the procedure that renews the default certificates as described in the following alerts: Tivoli Workload Scheduler distributed environment: Tivoli Workload Scheduler z/os environment: 2 Recovering from the December 10, 2013 automatic renewal of default certificates

9 Error messages in the SystemOut.log file When the expiration date is reached, your Tivoli Workload Scheduler components do not communicate among themselves. The SystemOut.log file contains the corresponding error messages, which depend on the Tivoli Workload Scheduler version and components you have installed. Error messages Tivoli Workload Scheduler V8.4 [12/30/13 13:33:05:992 CET] a WorkSpaceMana A WKSP0500I: Workspace configuration consistency check is false. [12/30/13 13:33:06:792 CET] a StartCertific A Self Signed Certificate: notbefore time: Sun Dec 29 13:33:06 CET 2013 notafter time: Mon Dec 29 13:33:06 CET 2014 [12/30/13 13:33:06:901 CET] a WSNotifier I CWPKI0037I: Expiration monitor reports the following information: *** CERTIFICATES THAT ARE BEYOND THE EXPIRATION THRESHOLD *** Checking for expired certificate and certificates about to expire CWPKI0643I: Personal certificate alias "server" in KeyStore " NodeDefaultKeyStore " will expire on February 10, CWPKI0642I: Signer certificate alias "client" in KeyStore " NodeDefaultTrustStore" will expire on February 10, *** CERTIFICATES THAT ARE BEYOND THE EXPIRATION THRESHOLD AND HAVE BEEN REPLACED *** CWPKI0645I: Personal certificate alias " server " in KeyStore "NodeDefaultKeyStore" was REPLACED.. [12/30/13 13:33:07:855 CET] a FileRepositor A ADMR0010I: Document cells/defaultnode/security.xml is modified.[12/30/13 13:33:08:086 CET] a SSLComponentI I CWPKI0002I: SSL service initialization completed successfully Dynamic Workload Console V8.4 [12/30/13 13:28:00:946 CET] a WSNotifier I CWPKI0037I: Expiration monitor reports the following information: *** CERTIFICATES THAT ARE BEYOND THE EXPIRATION THRESHOLD *** Checking for expired certificate and certificates about to expire CWPKI0642I: Signer certificate alias "twstrustkey" in KeyStore "NodeDefaultTrustStore" will expire on February 10, [12/30/13 13:28:01:619 CET] a FileRepositor A ADMR0010I: Document cells/nc125177node01cell/security.xml is modified. [12/30/13 13:28:01:822 CET] a SSLComponentI I CWPKI0002I: SSL service initialization completed successfully Tivoli Workload Scheduler V8.5 and V8.5.1 *** CERTIFICATES THAT ARE BEYOND THE EXPIRATION THRESHOLD *** Checking for expired certificate and certificates about to expire CWPKI0643I: Personal certificate alias "server" in KeyStore " NodeDefaultKeyStore " will expire on February 10, CWPKI0642I: Signer certificate alias "client" in KeyStore "NodeDefaultTrustStore" will expire on February 10, CWPKI0642I: Signer certificate alias "twstrustkey" in KeyStore "NodeDefaultTrustStore" will expire on February 10, Tivoli Workload Scheduler components that are affected by default certificate automatic renewal 3

10 *** CERTIFICATES THAT ARE BEYOND THE EXPIRATION THRESHOLD AND HAVE BEEN REPLACED *** CWPKI0645I: Personal certificate alias " server " in KeyStore "NodeDefaultKeyStore" was REPLACED. CWPKI0644I: Signer certificate alias "twstrustkey" in KeyStore "NodeDefaultTrustStore" was REPLACED.. [12/30/13 13:09:28:165 CET] e FileRepositor A ADMR0016I: User nc romelab.it.ibm.com/remo851 modified document cells/defaultnode/security.xml. Dynamic Workload Console V8.5 and V8.5.1 *** CERTIFICATES THAT ARE BEYOND THE EXPIRATION THRESHOLD *** Checking for expired certificate and certificates about to expire CWPKI0643I: Personal certificate alias "server" in KeyStore " NodeDefaultKeyStore " will expire on February 10, CWPKI0642I: Signer certificate alias "client" in KeyStore "NodeDefaultTrustStore" will expire on February 10, CWPKI0642I: Signer certificate alias "twstrustkey" in KeyStore "NodeDefaultTrustStore" will expire on February 10, *** CERTIFICATES THAT ARE BEYOND THE EXPIRATION THRESHOLD AND HAVE BEEN REPLACED *** CWPKI0645I: Personal certificate alias " server " in KeyStore "NodeDefaultKeyStore" was REPLACED. CWPKI0644I: Signer certificate alias "twstrustkey" in KeyStore "NodeDefaultTrustStore" was REPLACED.. [12/30/13 13:31:54:801 CET] b FileRepositor A ADMR0016I: User nc romelab.it.ibm.com/tdwcuser modified document cells/defaultnode/security.xml. Connection log after Certs replaced [12/30/13 13:37:18:723 CET] WSX509TrustMa E CWPKI0022E: SSL HANDSHAKE FAILURE: A signer with SubjectDN "CN=Server, OU=TWS, O=IBM, C=US" was sent from target host:port " :31120". The signer may need to be added to local trust store "/home/tdwcuser/ewas/profiles/twaprofile/etc/twsservertrustfile.jks" located in SSL configuration alias "DefaultNode/DefaultSSLSettings" loaded from SSL configuration file "security.xml". The extended error message from the SSL handshake exception is: "No trusted certificate found". z/os connector V8.5 and V8.5.1 [12/30/13 14:22:35:437 CET] f WSNotifier I CWPKI0037I: Expiration monitor reports the following information: *** CERTIFICATES THAT ARE BEYOND THE EXPIRATION THRESHOLD *** Checking for expired certificate and certificates about to expire CWPKI0643I: Personal certificate alias "server" in KeyStore " NodeDefaultKeyStore " will expire on February 10, CWPKI0642I: Signer certificate alias "client" in KeyStore "NodeDefaultTrustStore" will expire on February 10, CWPKI0642I: Signer certificate alias "twstrustkey" in KeyStore "NodeDefaultTrustStore" will expire on February 10, Recovering from the December 10, 2013 automatic renewal of default certificates

11 *** CERTIFICATES THAT ARE BEYOND THE EXPIRATION THRESHOLD AND HAVE BEEN REPLACED *** CWPKI0645I: Personal certificate alias " server " in KeyStore "NodeDefaultKeyStore" was REPLACED. CWPKI0644I: Signer certificate alias "twstrustkey" in KeyStore "NodeDefaultTrustStore" was REPLACED.. [12/30/13 14:22:35:996 CET] f FileRepositor A ADMR0016I: User nc romelab.it.ibm.com/remozconn modified document cells/defaultnode/security.xml. Tivoli Workload Scheduler V8.6 Checking for expired certificate and certificates in the 60 days threshold period. *** CERTIFICATES THAT ARE EXIPIRED OR IN THE EXPIRATION THRESHOLD ***; CWPKI0643I: Personal certificate alias "server" in KeyStore "NodeDefaultKeyStore((cell):TIPCell:(node):TIPNode)" will expire on Feb 10, CWPKI0642I: Signer certificate alias "twstrustkey" in KeyStore "NodeDefaultTrustStore((cell):TIPCell:(node):TIPNode)" will expire on Feb 10, CWPKI0642I: Signer certificate alias "client" in KeyStore "NodeDefaultTrustStore((cell):TIPCell:(node):TIPNode)" will expire on Feb 10, *** CERTIFICATES THAT ARE EXPIRED OR BEYOND THE EXPIRATION THRESHOLD AND HAVE BEEN REPLACED ***; CWPKI0645I: Personal certificate alias "server" in KeyStore "NodeDefaultKeyStore((cell):TIPCell:(node):TIPNode)" was REPLACED. CWPKI0644I: Signer certificate alias "twstrustkey" in KeyStore "NodeDefaultTrustStore((cell):TIPCell:(node):TIPNode)" was REPLACED. *** CERTIFICATES THAT ARE EXPIRED OR BEYOND THE EXPIRATION THRESHOLD THAT CANNOT BE REPLACED BY THE SERVER ***; CWPKI0642I: Signer certificate alias "client" in KeyStore "NodeDefaultTrustStore((cell):TIPCell:(node):TIPNode)" will expire on Feb 10, [12/30/13 13:07:22:401 CET] f FileRepositor A ADMR0016I: User localhost.localdomain/giulia86 modified document cells/tipcell/security.xml. [12/30/13 13:07:36:028 CET] JobSchedulerS W Server properties not found: using defaults [12/30/13 13:07:36:043 CET] servlet I com.ibm.ws.webcontainer.servlet.servletwrapper init SRVE0242I: [ITDWB] [/JobManagerRESTWeb] [JobSchedulerServlet]: Initialization successful. For dynamic domain manager: Checking for expired certificate and certificates in the 60 days threshold period. *** CERTIFICATES THAT ARE EXIPIRED OR IN THE EXPIRATION THRESHOLD ***; CWPKI0643I: Personal certificate alias "server" in KeyStore "NodeDefaultKeyStore((cell):TIPCell:(node):TIPNode)" will expire on Feb 10, CWPKI0642I: Signer certificate alias "twstrustkey" in KeyStore "NodeDefaultTrustStore((cell):TIPCell:(node):TIPNode)" will expire on Feb 10, CWPKI0642I: Signer certificate alias "client" in KeyStore Tivoli Workload Scheduler components that are affected by default certificate automatic renewal 5

12 "NodeDefaultTrustStore((cell):TIPCell:(node):TIPNode)" will expire on Feb 10, CWPKI0680I: Personal certificate alias "default" in KeyStore "NodeRSATokenKeyStore((cell):TIPCell:(node):TIPNode)" expired on Feb 25, CWPKI0643I: Personal certificate alias "default" in KeyStore "NodeRSATokenKeyStore((cell):TIPCell:(node):TIPNode)" will expire on Feb 25, *** CERTIFICATES THAT ARE EXPIRED OR BEYOND THE EXPIRATION THRESHOLD AND HAVE BEEN REPLACED ***; CWPKI0645I: Personal certificate alias "default" in KeyStore "NodeRSATokenKeyStore((cell):TIPCell:(node):TIPNode)" was REPLACED. CWPKI0645I: Personal certificate alias "server" in KeyStore "NodeDefaultKeyStore((cell):TIPCell:(node):TIPNode)" was REPLACED. CWPKI0644I: Signer certificate alias "twstrustkey" in KeyStore "NodeDefaultTrustStore((cell):TIPCell:(node):TIPNode)" was REPLACED. *** CERTIFICATES THAT ARE EXPIRED OR BEYOND THE EXPIRATION THRESHOLD THAT CANNOT BE REPLACED BY THE SERVER ***; CWPKI0642I: Signer certificate alias "client" in KeyStore "NodeDefaultTrustStore((cell):TIPCell:(node):TIPNode)" will expire on Feb 10, [12/30/13 13:06:48:090 CET] FileRepositor A ADMR0016I: User nc romelab.it.ibm.com/remoddm modified document cells/tipcell/security.xml. [12/30/13 13:06:49:063 CET] b JobSchedulerS W Server properties not found: using defaults [12/30/13 13:06:49:068 CET] b servlet I com.ibm.ws.webcontainer.servlet.servletwrapper init SRVE0242I: [ITDWB] [/JobManagerRESTWeb] [JobSchedulerServlet]: Initialization successful. How to restore the default certificates for components with embedded WebSphere Application Server installed on distributed platforms This procedure disables the embedded WebSphere Application Server mechanism that generates random certificates and then restores the old default certificates that expire on February 10, About this task Apply the following procedure to each component that has embedded WebSphere Application Server installed on distributed platforms, except for the Dynamic Workload Console V8.4.0: 1. Log on as Administrator on Windows operating systems, or as root on UNIX and Linux operating systems, on the machine where the Tivoli Workload Scheduler component is installed. 2. Stop the WebSphere Application Server embedded in the component: To stop the embedded WebSphere Application Server, perform the command stopserver.bat on Windows operating systems and stopserver.sh on UNIX and Linux operating systems. Reply "y" to the prompt Add signer to the trust store now? (y/n). On UNIX and LINUX operating systems: If you stop the WebSphere Application Server on UNIX and Linux 6 Recovering from the December 10, 2013 automatic renewal of default certificates

13 operating systems, by running the stopserver.sh script from the embedded WebSphere Application Server binary directory, you have the following output: #./stopserver.sh server1 -user twsuser -password twsuserpwd ADMU0116I: Tool information is being logged in file /opt/ibm/twatdwc/ewas/profiles/tipprofile/logs/server1/stopserver.log ADMU0128I: Starting tool with the TIPProfile profile ADMU3100I: Reading configuration for server: server1 *** SSL SIGNER EXCHANGE PROMPT *** SSL signer from target host is not found in trust store /opt/ibm/twatdwc/ewas/profiles/tipprofile/etc/twsclienttrustfile.jks. Here is the signer information (verify the digest value matches what is displayed at the server): Subject DN: CN=ServerNew, OU=TWS, O=IBM, C=US Issuer DN: CN=ServerNew, OU=TWS, O=IBM, C=US Serial number: Expires: Tue Nov 09 09:48:19 CET 2032 SHA-1 Digest: 5D:16:5D:17:3B:5F:BF:B7:EA:19:92:22:2D:36:53:1A:2F:9D:1B:26 MD5 Digest: DB:BA:A2:6D:0D:B6:A2:53:35:6D:32:6A:40:20:D5:36 Add signer to the trust store now? (y/n)y A retry of the request may need to occur if the socket times out while waiting for a prompt response. If the retry is required, note that the prompt will not be redisplayed if is entered, which indicates the signer has already been added to the trust store. ADMU3201I: Server stop request issued. Waiting for stop status. ADMU4000I: Server server1 stop completed. On Windows operating systems: If you stop the WebSphere Application Server on Windows operating systems, by running the stopserver.bat script from the embedded WebSphere Application Server binary directory, you have the following output. Note: After submitting the stopserver.bat script to run, it might occur that the output scrolls too quickly and you are not able to answer "y" to the prompt "Add signer to the trust store now? (y/n)". Submit the script to run again and you will be able to answer "y" to the prompt. C:\TWA2\eWAS\bin>stopServer.bat server1 ADMU0116I: Tool information is being logged in file C:\TWA2\eWAS\profiles\TIPProfile\logs\server1\stopServer.log ADMU0128I: Starting tool with the TIPProfile profile ADMU3100I: Reading configuration for server: server1 *** SSL SIGNER EXCHANGE PROMPT *** SSL signer from target host is not found in trust store C:/TWA2/eWAS/profiles/TIPProfile/etc/TWSClientTrustFile.jks. Here is the signer information (verify the digest value matches what is displayed at the server): Subject DN: CN=ServerNew, OU=TWS, O=IBM, C=US Issuer DN: CN=ServerNew, OU=TWS, O=IBM, C=US Serial number: Expires: Mon Nov 08 20:48:19 GMT-12: SHA-1 Digest: 5D:16:5D:17:3B:5F:BF:B7:EA:19:92:22:2D:36:53:1A:2F:9D:1B:26 MD5 Digest: DB:BA:A2:6D:0D:B6:A2:53:35:6D:32:6A:40:20:D5:36 Add signer to the trust store now? (y/n)y A retry of the request may need to occur if the socket times out while waiting f or a prompt response. If the retry is required, note that the prompt will not b e redisplayed if is entered, which indicates the signer has already been add ed to the trust store. ADMU3201I: Server stop request issued. Waiting for stop status. ADMU4000I: Server server1 stop completed. Tivoli Workload Scheduler components that are affected by default certificate automatic renewal 7

14 Note: If the prompt appears quickly the first time and you are unable to reply to the answer, perform the stop action another time and you are able to reply to the prompt. For more information about the command syntax, see Tivoli Workload Scheduler: Administration Guide > Administrative tasks > Application Server tasks. Note: Check that the WebSphere Application Server process is not running before proceeding. If the process is still active, stop manually the following processes: v The WebSphere Application Server Java process v Its monitoring process appservman, if active v The WASService.exe process (only on Windows operating systems) 3. Create a copy of the following WebSphere Application Server configuration file: Tivoli Workload Scheduler V8.4 On Windows operating systems: <INST_DIR>\appserver\profiles\<WAS_PROFILE_NAME>\config\ cells\<was_cell_name>\security.xml On UNIX and Linux operating systems: <INST_DIR>/appserver/profiles/<WAS_PROFILE_NAME>/config/ cells/<was_cell_name>/security.xml Tivoli Workload Scheduler and Dynamic Workload Console V8.5, V8.5.1 and V8.6 On Windows operating systems: <INST_DIR>\eWAS\profiles\<WAS_PROFILE_NAME>\config\cells\ <WAS_CELL_NAME>\security.xml On UNIX and Linux operating systems: <INST_DIR>/eWAS/profiles/<WAS_PROFILE_NAME>/config/cells/ <WAS_CELL_NAME>/security.xml Where: <INST_DIR> Is the Tivoli Workload Scheduler component installation directory. <WAS_PROFILE_NAME> Is the WebSphere Application Server profile name. <WAS_CELL_NAME> Is the WebSphere Application Server cell name. 4. To disable the embedded WebSphere Application Server mechanism that generates random certificates perform the following actions: a. Edit the security.xml, by locating the following tag: <wscertificateexpirationmonitor... name="certificate Expiration Monitor" autoreplace="true" deleteold="true" "/> and deleting the following properties: autoreplace="true" deleteold="true" 5. To restore the old default certificates that expire on February 10, 2014, perform the following actions: a. Create a backup of the following directory: Tivoli Workload Scheduler V8.4 8 Recovering from the December 10, 2013 automatic renewal of default certificates

15 On Windows operating systems: <INST_DIR>\appserver\profiles\<WAS_PROFILE_NAME>\etc On UNIX and Linux operating systems: <INST_DIR>/appserver/profiles/<WAS_PROFILE_NAME>/etc Tivoli Workload Scheduler and Dynamic Workload Console V8.5, V8.5.1 and V8.6 On Windows operating systems: <INST_DIR>\eWAS\profiles\<WAS_PROFILE_NAME>\etc On UNIX and Linux operating systems: <INST_DIR>/eWAS/profiles/<WAS_PROFILE_NAME>/etc b. Perform the following actions: Tivoli Workload Scheduler V8.4 On Windows operating systems: Into the <INST_DIR>\appserver\profiles\ <WAS_PROFILE_NAME>\etc directory, copy the following certificates: v <INST_DIR>\appserver\profileTemplates\default\ documents\etc\twsserverkeyfile.jks v <INST_DIR>\appserver\profileTemplates\default\ documents\etc\twsservertrustfile.jks v <INST_DIR>\appserver\profileTemplates\default\ documents\etc\twsclientkeyfile.jks v <INST_DIR>\appserver\profileTemplates\default\ documents\etc\twsclienttrustfile.jks On UNIX and Linux operating systems: Into the <INST_DIR>/appserver/profiles/ <WAS_PROFILE_NAME>/etc directory, copy the following certificates: v <INST_DIR>/appserver/profileTemplates/default/ documents/etc/twsserverkeyfile.jks v <INST_DIR>/appserver/profileTemplates/default/ documents/etc/twsservertrustfile.jks v <INST_DIR>/appserver/profileTemplates/default/ documents/etc/twsclientkeyfile.jks v <INST_DIR>/appserver/profileTemplates/default/ documents/etc/twsclienttrustfile.jks Tivoli Workload Scheduler and Dynamic Workload Console V8.5, V8.5.1 and V8.6 On Windows operating systems: Into the <INST_DIR>\eWAS\profiles\<WAS_PROFILE_NAME>\etc directory, copy the following certificates: v <INST_DIR>\eWAS\profileTemplates\default\documents\ etc\twsserverkeyfile.jks v <INST_DIR>\eWAS\profileTemplates\default\documents\ etc\twsservertrustfile.jks v <INST_DIR>\eWAS\profileTemplates\default\documents\ etc\twsclientkeyfile.jks Tivoli Workload Scheduler components that are affected by default certificate automatic renewal 9

16 v <INST_DIR>\eWAS\profileTemplates\default\documents\ etc\twsclienttrustfile.jks On UNIX and Linux operating systems: Into the <INST_DIR>/eWAS/profiles/<WAS_PROFILE_NAME>/etc directory, copy the following certificates: v <INST_DIR>/eWAS/profileTemplates/default/documents/ etc/twsserverkeyfile.jks v <INST_DIR>/eWAS/profileTemplates/default/documents/ etc/twsservertrustfile.jks v <INST_DIR>/eWAS/profileTemplates/default/documents/ etc/twsclientkeyfile.jks v <INST_DIR>/eWAS/profileTemplates/default/documents/ etc/twsclienttrustfile.jks 6. (Optional) Apply the procedure that renews the default certificates. For more information about this procedure, see: distributed environment z/os environment 7. Start the WebSphere Application Server embedded in the component by running: On Windows operating systems: startwas.bat On UNIX and Linux operating systems: startwas.sh For more information about the command syntax, see Tivoli Workload Scheduler: Administration Guide > Administrative tasks > Application Server tasks. Note: Dynamic Workload Console V8.4.0 does not have a recovery procedure that you can apply. Instead you must perform recovery actions on the components to which it is connected and, apply as soon as possible the renewing certificate procedure, as described in: Tivoli Workload Scheduler distributed environment: Tivoli Workload Scheduler z/os environment: Note: If you performed step 5b on page 9 with the WebSphere Application Server process running, when you stop the WebSphere Application Server for the first time, you are asked to accept the new client truststore for the Tivoli Workload Scheduler component. To accept the new truststore during the running of stopserver.bat on Windows operating systems and stopserver.sh on UNIX and Linux operating systems, reply "y" to the prompt Add signer to the trust store now? (y/n). 10 Recovering from the December 10, 2013 automatic renewal of default certificates

17 Notices This information was developed for products and services offered in the U.S.A. IBM may not offer the products, services, or features discussed in this document in other countries. Consult your local IBM representative for information on the products and services currently available in your area. Any reference to an IBM product, program, or service is not intended to state or imply that only that IBM product, program, or service may be used. Any functionally equivalent product, program, or service that does not infringe any IBM intellectual property right may be used instead. However, it is the user's responsibility to evaluate and verify the operation of any non-ibm product, program, or service. IBM may have patents or pending patent applications covering subject matter described in this document. The furnishing of this document does not give you any license to these patents. You can send license inquiries, in writing, to: IBM Director of Licensing IBM Corporation North Castle Drive Armonk, NY U.S.A. For license inquiries regarding double-byte (DBCS) information, contact the IBM Intellectual Property Department in your country or send inquiries, in writing, to: Intellectual Property Licensing Legal and Intellectual Property Law IBM Japan, Ltd , Nihonbashi-Hakozakicho, Chuo-ku Tokyo , Japan The following paragraph does not apply to the United Kingdom or any other country where such provisions are inconsistent with local law: INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or implied warranties in certain transactions, therefore, this statement might not apply to you. This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the publication. IBM may make improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time without notice. Any references in this information to non-ibm websites are provided for convenience only and do not in any manner serve as an endorsement of those websites. The materials at those websites are not part of the materials for this IBM product and use of those websites is at your own risk. Copyright IBM Corp. 2001,

18 IBM may use or distribute any of the information you supply in any way it believes appropriate without incurring any obligation to you. Licensees of this program who wish to have information about it for the purpose of enabling: (i) the exchange of information between independently created programs and other programs (including this one) and (ii) the mutual use of the information which has been exchanged, should contact: IBM Corporation 2Z4A/ Burnet Road Austin, TX U.S.A. Such information may be available, subject to appropriate terms and conditions, including in some cases payment of a fee. The licensed program described in this document and all licensed material available for it are provided by IBM under terms of the IBM Customer Agreement, IBM International Program License Agreement or any equivalent agreement between us. This information contains examples of data and reports used in daily business operations. To illustrate them as completely as possible, the examples include the names of individuals, companies, brands, and products. All of these names are fictitious and any similarity to the names and addresses used by an actual business enterprise is entirely coincidental. Trademarks IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International Business Machines Corporation in the United States, other countries, or both. If these and other IBM trademarked terms are marked on their first occurrence in this information with a trademark symbol ( or ), these symbols indicate U.S. registered or common law trademarks owned by IBM at the time this information was published. Such trademarks may also be registered or common law trademarks in other countries. A current list of IBM trademarks is available on the Web at "Copyright and trademark information" at copytrade.shtml. Adobe, the Adobe logo, PostScript, and the PostScript logo are either registered trademarks or trademarks of Adobe Systems Incorporated in the United States, and/or other countries. IT Infrastructure Library is a registered trademark of the Central Computer and Telecommunications Agency which is now part of the Office of Government Commerce. Intel, Intel logo, Intel Inside, Intel Inside logo, Intel Centrino, Intel Centrino logo, Celeron, Intel Xeon, Intel SpeedStep, Itanium, and Pentium are trademarks or registered trademarks of Intel Corporation or its subsidiaries in the United States and other countries. Linux is a registered trademark of Linus Torvalds in the United States, other countries, or both. 12 Recovering from the December 10, 2013 automatic renewal of default certificates

19 Microsoft, Windows, Windows NT, and the Windows logo are trademarks of Microsoft Corporation in the United States, other countries, or both. ITIL is a registered trademark, and a registered community trademark of The Minister for the Cabinet Office, and is registered in the U.S. Patent and Trademark Office UNIX is a registered trademark of The Open Group in the United States and other countries. Java and all Java-based trademarks and logos are trademarks or registered trademarks of Oracle and/or its affiliates. Cell Broadband Engine is a trademark of Sony Computer Entertainment, Inc. in the United States, other countries, or both and is used under license therefrom. Linear Tape-Open, LTO, the LTO Logo, Ultrium, and the Ultrium logo are trademarks of HP, IBM Corp. and Quantum in the U.S. and other countries. Notices 13

20 14 Recovering from the December 10, 2013 automatic renewal of default certificates

21

22 Printed in USA