IJ57691 Automatic download of certificates will loop on Agent 10.2.6 agent did not update automatically the certs and can cause disconnect of the Agent

Problem

Applies to IBM Workload Automation Agent v10.2.6 -DA only-

Issue On DA Agent version 10.2.6, the automatic certificate download process may enter a loop. When this occurs, the agent fails to update certificates automatically, which can eventually lead to the agent disconnecting from the server.

Resolution: The IJ57691 formal fix is available on IBM Fixcentral for version 10.2.6. It is recommended to install this iFix to resolve the issue permanently. Alternatively, follow the manual certificate replacement procedure outlined in the

https://www.ibm.com/docs/en/workload-automation/10.2.6?topic=communications-certificate-rotation

For MDM agent the certificates should be rotate manually.

Workaround If the iFix cannot be applied immediately, use one of the following two methods:

Option 1: Manual Certificate Update

1. Verify if the certificates in the master domain manager depot folder are set to expire within 15 days.
2. Shut down the Agent and wait for all JobManager processes to terminate.
3. Run the AgentCertificateDownloader script from the Agent to manually update all files in the TWSDATA/ssl/certs folder.
4. Restart the Agent and verify that the certificate download thread is no longer stuck in a loop.

Option 2: Disable Automatic Rotation The download loop is triggered by a parameter in the BrokerWorkstation.properties file. By default, this is set to 15 days.

1. Open the BrokerWorkstation.properties file.
2. Add (or modify) the following hidden key: Broker.CertificateExpirationInterval=0
3. Restart the Liberty service. Note: Setting this to 0 prevents the loop, but certificates must be rotated manually before they expire.