Back in 1997 Security Dynamics, the company that eventually bought RSA and re-named itself, generated an MD5 signed Certificate named sdti.cer. It was Issued to and by itself, therefore it was a Root CA signing Certificate. This sdti.cer.file was part of every license for ACE/ Authentication Manager, and was used to sign the server.cer file unique to your licensed deployment. That sdti.cer. file expired in November of 2017. Your server.cer file would expire 20 years after your license file was generated, therefore the earliest adopters of Authentication Manager 8.0 might have an expiration date of 2031.
TCP port 5550 is the auto-registration service port for Authentication Agents for Windows, and auto-registering Windows agents would have been installed with a copy of your server.cer file, which could be downloaded from the Security Console - Access - Authentication Agents.
RSA has documentation / engineering responses that TLS/SSL is only used for obscuring and is not the encryption method used on TCP port 5550. The only way to do that is to download an upgraded license file that has a SHA signed sdti.cer, and deploy a new primary, which could be a rather challenging proposal depending on how many agents you have.
If you open a support case, you can ask the TSE for more details, including the internal KB 35744 | What is the sdti.cer file, and how does it affect an RSA Authentication Manager server deployment?
As well as Engineering responses concerning the use of self-signed certificates and various encryption methods used on our legacy agents, some of which is under NDA.
