2

Context

We have a fully scaled architecture where CM and Publisher servers are separate. We use the aDAM Tridion connector for connecting with aDAM for digital assets via the connector and the ECL layer. The certificate thumbprints are cross shared between aDAM and Tridion such that Tridion STS xml has the aDAM certificate thumbprint and Tridion STS certificate thumbprint and aDAM has Tridion STS certificate thumbprints in the web.config for the connector service on the aDAM side.

Issue:

Since the last week, the Tridion STS certificate (used for connection authorization between aDAM and Tridion) is getting deleted from the personal keystore automatically. Not sure why this is happening and wanted to check if anybody in the community faced similar issue. I am looking into the servers to see what has changed since the last week but have not been able to find the root cause as yet. The certificate has read permissions for the service accounts that Tridion uses. Only administrator group has full control over the certificate. Also, the certificate is getting deleted only from the personal store, it is not getting deleted from the Trusted root.

Please let me know if anybody has suggestions of areas to look into.

Update:

I've looked into multiple aspects and finally found the symptom of the issue to be somewhere in the policy server where the windows event tries to invoke policy for certificate enrollment from the policy server every few hours and after which the certificate is getting removed from the servers.
There are no logs or information where it is saying that the certificate is being removed, but every time after this event, the certificate is removed.

So far have not found the root cause of why only the certificate used by TridionSTS is getting deleted while other certificate with similar issuer on the same server in the personal store are not getting removed.

I will update with an answer when I find the root cause and the fix for the same

  • Do you have any group policies that are manage the certificate stores across the domain? – Dominic Cronin May 2 '15 at 19:47
  • yes we have group policy for certificate stores and I checked that all the certificates (including third party SSL) are enabled by verifying the policy by executing gpresult /h foo.html on the servers. – Vipin Kothari May 2 '15 at 19:54
  • Have you added the certificates in the Personal folder of the Local Computer or of the current user? They have to in the Local Computer store – Raimond May 6 '15 at 9:11
  • It is in local computer not the current user – Vipin Kothari May 6 '15 at 15:17
1

It turned out that the certificates were auto renewed 6 weeks prior to expiry and the group policy defines that post auto renewal, there will be a new certificate created with a new thumbprint and the old one will be deleted every time the policy enrollment event happens. This caused the certificates to be continuously deleted even though they were still valid, since a new one is available on the server:( We ran into issues since Tridion STS and ADAM webservice were using old thumbprint and it caused a lot of failures on CME and publishing. The issue is finally resolved

| improve this answer | |
  • 1
    I'm glad that my suggestion of checking your group policies was helpful, as, it seems, was Peter's information. – Dominic Cronin May 12 '15 at 10:23
0

I have actually run into a similar problem before. I think I fixed it by placing the certificate under Trusted People instead of Personal (i.e. make sure the certificate is explicitly trusted). I'm not sure if that's actually the best solution but you could try it.

The root cause had to do with a domain policy removing the certificate on a regular basis.

| improve this answer | |
  • I will try this approach. But, other certificates which are by the same issuers with same certificate templates etc in the personal folder are not getting deleted. So, I am not sure if this will fix the problem. – Vipin Kothari May 6 '15 at 15:22
  • I added the certificate in Trusted People and it is still getting deleted :( – Vipin Kothari May 8 '15 at 18:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.