We have a fully scaled architecture where CM and Publisher servers are separate. We use the aDAM Tridion connector for connecting with aDAM for digital assets via the connector and the ECL layer. The certificate thumbprints are cross shared between aDAM and Tridion such that Tridion STS xml has the aDAM certificate thumbprint and Tridion STS certificate thumbprint and aDAM has Tridion STS certificate thumbprints in the web.config for the connector service on the aDAM side.
Since the last week, the Tridion STS certificate (used for connection authorization between aDAM and Tridion) is getting deleted from the personal keystore automatically. Not sure why this is happening and wanted to check if anybody in the community faced similar issue. I am looking into the servers to see what has changed since the last week but have not been able to find the root cause as yet. The certificate has read permissions for the service accounts that Tridion uses. Only administrator group has full control over the certificate. Also, the certificate is getting deleted only from the personal store, it is not getting deleted from the Trusted root.
Please let me know if anybody has suggestions of areas to look into.
I've looked into multiple aspects and finally found the symptom of the issue to be somewhere in the policy server where the windows event tries to invoke policy for certificate enrollment from the policy server every few hours and after which the certificate is getting removed from the servers.
There are no logs or information where it is saying that the certificate is being removed, but every time after this event, the certificate is removed.
So far have not found the root cause of why only the certificate used by TridionSTS is getting deleted while other certificate with similar issuer on the same server in the personal store are not getting removed.
I will update with an answer when I find the root cause and the fix for the same