How to proactively renew Change Auditor certificate used for On Demand Audit integration (4255592)

Upon the initial upgrade to 7.0.3 (or higher) version, Change Auditor coordinator creates a certificate on the local machine to facilitate event forwarding to On Demand Audit. This certificate will expire after one year. The certificate is subsequently not renewed automatically.  This leads to a failure maintaining a connection between Change Auditor and On Demand Audit as On Demand Audit no longer trusts the expired Change Auditor certificate(s) in use.

The certificate can be proactively renewed on each coordinator to extend the expiration date one year to avoid an unscheduled connectivity lose incident.

WORKAROUND:

1. Sign-in to On Demand
   Note: Take important care at this time to document the Deployment Region and Organization Name in use
2. Navigate to Audit module and then Configuration tab
3. Click the ellipses in the top-right corner of the impacted Change Auditor Installation(s) tile(s) and select 'Remove Installation' option
4. When prompted with the warning, "Remove Installation. Are you sure you want to remove this Change Auditor installation? This will cause events to stop being forwarded from Change Auditor." click OK
5. Run CertLM.msc command from command prompt on ALL coordinator servers in the Installation
6. Delete the existing ‘OnDemandAuditCAIntegration’ certificate from ALL coordinators which are expiring in the near future
7. Restart the ‘Quest Change Auditor Coordinator’ service on ALL Change Auditor coordinator servers in the impacted Installation. New ‘OnDemandAuditCAIntegration’ certificate will be created on each coordinator server during start-up
8. Open the Change Auditor client, connect to the impacted Installation and navigate to View | Administration | Configuration | On Demand Audit
9. Select the “Sign in and Configure” option and configure the Change Auditor Installation to send events to On Demand Audit. Ensure the previously used Deployment Region and Organization Name are selected
10. Event forwarding from Change Auditor will now resume from the last successfully forwarded event position
11. Wait 5-10 minutes and confirm Change Auditor Installation shows "Connected and receiving events" status in Audit Configuration tab

STATUS:

This issue is resolved in CA 7.1.1 and later.

Note: If you don't intend to use ODA or other OnDemand products, you can simply remove the certificate and the coordinator will regenerate a new one the next time the service starts up.