Revoke certificate tasks getting failed in production - Support and Troubleshooting

Revoke certificate tasks getting failed in production Issue

All the revoke certificate tasks getting failed.

Resolution

Upon checking the two revoke tasks provided.

1. #Reason for revoking the certificate: This is to update origin-noblewebchat.wyndhamdestinations.com is decom already so no need to renew certificate.

Certificate request was approved by approver (361158).

Flow cannot be triggered as Routing Policy was not specified during approval. Task has Failed.

Single routing policy is not matched so manual intervention is needed. The approve must choose the proper routing policy for requesting the revoke certificate.

2. #Reason for revoking the certificate: No longer in use.

Certificate request was rejected by approver (361158).

Single routing policy is not matched so manual intervention is needed. The approve must choose the proper routing policy for requesting the revoke certificate.

--> In DigiCert_Routing_Policy

https:// .service-now.com/sn_disco_certmgmt_routing_policy.do?sys_id=e456362d1b329d10d17eebd1604bcb64

--> As per following document Automated certificate management for TLS certificates https://docs.servicenow.com/bundle/sandiego-it-operations-management/page/product/discovery/concept/automated-cert-requests.html

Routing policy details There are three different scenarios for how routing policies work for automated certificate management for TLS certificates.

Scenario 1: A single routing policy matches and manual approval is required. The approver can verify the task details and approve the certificate request. Once approved, this triggers the automated flow. Scenario 2: No routing policy matches OR there are multiple routing policies that match. The approver can verify the task details and select Choose Routing Policy & Approve. The approver needs to manually select the routing policy. The updated routing policy then displays. The approver selects the routing policy which then triggers the automated flow. Scenario 3: A single routing policy matches, manual approval is not required, and Approval Required flag is inactive. This triggers the automatic flow.

Note: If the approver has rejected the certificate request task, the task is marked as Failed. A single approval is enough for triggering the automated flow progress.

Cause and Resolution: --> We see in the tasks that the Routing policy is missing because Routing Policy was not specified during approval. Please choose the routing policy manually and then click on Approve.

Ask customer to create a new routing policy to Test if that is populated or not when approver click on choose routing policy and approve . And deactivate the old routing policy Digicert for a while.

--> You can also suspect that this issue is happening because the service_type of the certificate is set to "none", If the certificates are generated through automated flow their service type is set to either "internal" or "external"

--> When a revoke task for a certificate is created, certificate_purpose for the task is set to service_type of the certificate, now in this case the certificate_purpose for task got set to none

In the routing policy dialog we filter out routing policies based on the certificate_purpose. As the certificate_purpose for task is set to "none", it tries to search for routing policies with certificate_purpose as "none" as there are no routing policies with "none" no routing policy is displayed (As routing policy can only have internal or external)

-->Ask customer to confirm the following , they need to update the service_type of the certificate to "external" and create a new revoke task and check if the routing policies are displayed

--> If this is confirmed to be the root cause, then you can do a customization and remove the filter for certificate_purpose from cert_request_approve_dialog (In HTML on line ~43 remove ^certificate_purpose=${sysparm_cert_purpose})