Certificate Management - Renewal Tasks not generating

[Joe126]

Hi,

We want to use Certificate Management for managing certs.  At this time we are not implementing discovery or connecting to Certificate Authorities.  We are going to use the bulk upload process and then just want use the "management" aspect.  Getting renewal tasks created and assigned to groups/individuals. dashboards, etc.
In testing, I uploaded a bunch of dummy certs and cannot get any renewal tasks generated when I manually trigger the Certificate Notification and/or Certificate Event Notification jobs.
I did notice that for expired certs, a task is generated and incident created.   
I did fill out what I believe are the fields necessary - assigned to, change group, approval group, managed by, etc.

What am I missing?  

[Hamad Baseer]

Hi @Joe126 , 

Just to be clear what your ask is again. You want the Certificate Renewal Tasks (Manual flow) to be created when you run some scheduled job?

If that is the case. Then you need to do the following:

1. Verify Renewal tracking field is set to Create Priority 3 tasks on each Unique Certificate.
2. The Scheduled Job "Certificate Notification" in the Certificate Inventory and Management Scope needs to be activated or executed manually. 
3. This is the main OOB Scheduled Job that handles all logic for Manual and Auomated Rewewal tasks creation. The Script Includes called inside are protected and are uneditable. 
4. If Certificates are being discovered through ServiceNow's Discovery, and if you wish to control the Renewal tracking strategy by having your own logic. Then look for this system property "glide.discovery.certs.enable_renewal_task_creation_for_discovered_certificates" and set it to false.
5. You may want to run a fix script to mark all certificates Renewal tracking field to create P3 tasks. Then, run the scheduled job. Go to the renewal tasks table and verify the tasks have been created. 
6. Also go to email logs and see what kind of notifications are being fired. This entire process is OOB, with many scripts, email notifiactions, events, script actions, many tables and various logic within the scripts. 

Hope that helps!

Hamad

[Joe126]

Hi Hamad,

Correct - for all our Certs (uploaded via bulk process and showing in "Unique Certificates" table).

Renewal tracking field is set to Create Priority 3 tasks.
I have two certs - one expiring on 8/29 and the other on 09/17.  
I have run the "Certificate Notification" manually several times.
glide.discovery.certs.enable_renewal_task_creation_for_discovered_certificates 
is set to true

Not sure why it is not picking them up and creating tasks?  I feel like there is either a field or related record missing (relating to bulk upload as opposed to actual discover) that is skipping them.  I made sure all the owner, change group, etc all have values....

[Hamad Baseer]

Hi @Joe126 ,

In the Scheduled job, the SI that is being called, has a certain conditions that needs to match for processing "expiring" and "expired" certificates. Please inspect the SI and observe whether those conditions are being met. For any given unique cert, if renewal tracking is set to anything other than Dont create renewal task - It should create the renewal tasks for them.

Another thing is, the actual renewal tasks are created by a flow or a subflow. That Subflow is invoked from the SI. Check the flow execution logs and maybe you'll understand more of how this is supposed to work for you. 

Lastly, have you validated whether renewal tasks already exist with state open or closed? 

There are also 2 more system properties, both hold no. of days. But are intended for different reasons. One is for firing reminder notifiations when certs expiry date is at or less than 60 days. The other is for creating renewal tasks for certs that have expiry date at or less than 30 days. 

Let me know what you find. 

Hamad

[TKanko]

I ran to a similar issue but in my case I already had manual renewal tasks created once. I did some tweaking and set up assignment rules and what have you, I closed all the existing manual tasks in dev environment in order to test my changes and nothing happens. It turns out the subflow doesn't care if the task is closed in the past, it just checks if a task exists against the Unique certificate. So, once I deleted all the closed tasks, ran the shcedule again, everything works just fine.

My question is, how is this supposed to work in the long run? Am I supposed to create archive rules to the manual renewal task table with some interval suitable for the renewal frequency? Or is there already something in place that just didn't work for me as I was testing this in one go?

I tried to search oob best practices and suggestions how to handle the manual tasks but I couldn't find any. 

[drbob]

Not an area I've worked in but I saw this once when a colleague was demonstrating... after renewal there are two records - the current one and the expired one. I've a feeling the expired one is the newer record and the "current" one just keeps being updated (I recall thinking it was contrary to how you would expect). Anyway, whether the record changes or something on the certificate (if nothing else the expiry date) then that, the changed thing, might be what is used in the task generation logic (also, I don't have this in my PDI to check so can't poke around).

My point is that I expect this to work - have you tested a renewal and re-expiry and seen it fail ?