Installation or upgrade fails on RHEL version 9 and later

Installing or upgrading on RHEL version 9 and later fails if you were using default certificates.

About this task

Problem scenario

You are using a product version earlier than 10.2.1 with default certificates and you plan to upgrade to version 10.2.2, or you have upgraded to version 10.2.1 with default certificates and now plan to upgrade to 10.2.2. This problem can also occurs if you perform a parallel upgrade from versions 9.4 or 9.5, which require a fresh installation of HCL Workload Automation components. If one or more HCL Workload Automation components are installed on RHEL version 9 or later, the upgrade or fresh installation fails.

You might encounter an error message similar to the following:
AWSRES003E The REST service cannot be contacted. Check if the service is 
running or the existence of firewall rules or some issues on the dns side resolving 
the server hostname that could prevent contacting the service.

Cause and solution

The SHA-1 signatures contained in the HCL Workload Automation default certificates are not supported by the OpenSSL libraries embedded in RHEL version 9 or later. This is a known problem with RHEL version 9 and later. For more information, see Bug 2055796 - Enable SHA-1 signatures through LEGACY policy configuration.

To work around this problem, perform the following steps:

Procedure

  1. Stop all HCL Workload Automation services and WebSphere Application Server Liberty, by running the following commands: 
    conman stop; wait
conman shut; wait
conman ShutDownLwa
stopappserver
  2. Browse to the following paths:
    On UNIX™ operating systems
    TWA_DATA_DIR\ssl
    On Windows™ operating systems
    installation_dir\TWS\ssl
  3. Edit the openssl.cnf file as follows:
    • add the alg_section = evp_properties property in section [openssl_init].
    • create a new section named [evp_properties] with this content:
      
#to enable in RHEL-9 using the embedded OpenSSL 3.0.x the support of SHA-1 
#for signature creation and verification
rh-allow-sha1-signatures = yes
  4. Restart all HCL Workload Automation and WebSphere Application Server Liberty services by running the following commands: 
    conman start
conman startappserver
StartUpLwa