• RSA Identity Governance & Lifecycle 7.2.1
• RSA Identity Governance & Lifecycle 7.5.0
• SecurID Governance & Lifecycle 7.5.2

RSA Remote Agent shows as status "Is Running=Yes" but all Collectors for this Agent are failing. 

The Remote Agent's aveksaAgent.log file shows the following INFO level log messages with a warning:

05/20/2020 13:34:46.468 INFO  (ApplyChangesRegularThread-3) [com.aveksa.client.datacollector.framework.DataCollectorManager] WARNING: Hostname is not matched for session.

The aveksaAgent.log file shows a variety of other ERROR level messages related to the failure of the collectors to load JAVA classes:

05/20/2020 13:34:46.733 ERROR (ApplyChangesRegularThread-3) [com.aveksa.server.agent.message.ExceptionMessage] 
com.aveksa.common.ConfigException: Please ensure that all required classes are there in following urls: 
[https://{acm host}:8444/aveksa/DBIdentityCollector/, https://{acm host}:8444/aveksa/DBIdentityCollector1/classes/]

Testing a collector fails with a NullPointerException.  The aveksaAgent.log file shows an ERROR level log message related to the test:

05/20/2020 13:34:46.819 ERROR (ApplyChangesRegularThread-3) [com.aveksa.client.datacollector.framework.DataCollectorManager] FAILED method=Collect CollectionMetaInfo[{ID=1, run_id=381, collector_id=3, test-run=true, collector_name=IDC}] 
com.aveksa.common.ConfigException: java.lang.NullPointerException

There are no errors in the aveksaServer.log file and normal INFO level log messages indicate the remote agent is running:

05/20/2020 13:34:24.320 INFO  (default task-42) [com.aveksa.server.agent.core.AveksaAgent] Contact initiated from agent: OnPremise Integration Agent.Version: 2.0, Agent Runtime Data{dataTimestamp='1589981664320', hostname='{agent}', internalIp='10.10.10.10', externalIp='10.10.10.10', javaInstanceId='8692@{agent}', agentStartTime='1589981617657'}

Important Considerations for Certificate Configuration and Regeneration

Application version and certificate state are validated separately. Installing a supported release provides the capability to configure custom Subject Alternative Names (SANs), but it does not automatically regenerate server or client certificates. As a result, systems running a patched release will still encounter the Remote Agent failure until certificates are regenerated.

Note: Regenerating the application server certificate invalidates existing trust with connected agents. Updating this configuration requires a coordinated deployment of both the server certificate and new client certificates for all associated Remote Agent(s) and Local / Remote AFX instance(s).

Resolved Versions

The DomainNames custom setting is available in the following versions, allowing additional comma-separated hostnames or aliases to be added as DNS Names to the SAN extension of the application server certificate (port 8444):

• RSA Identity Governance & Lifecycle 7.2.1 P03

• RSA Identity Governance & Lifecycle 7.5.0

• SecurID Governance & Lifecycle 7.5.2

Hostname Matching and Configuration

Successful communication requires the hostname defined in the Remote Agent's server_url parameter (<RemoteAgent-install-dir>/conf/config.properties) to match exactly with an entry in the application server certificate's SAN extension.

Ensuring this alignment is critical for:

• Cloud / Proxy Deployments (e.g., AWS): Where the external hostname accessed by Remote Agent/AFX differs from the internal server instance hostname.

• Clustered Environments: Where individual nodes have different hostnames from the front-end load balancer.

Procedure & References:

• To configure the custom parameter, see the SecurID Governance & Lifecycle 7.5.2 Installation Guide, section "Using Domain Name for Certificate Validation".

• For step-by-step certificate update instructions, refer to: How to Update the Root (Server) and Client Certificates in RSA Identity Governance & Lifecycle.