JS7 JobScheduler

Space shortcuts

Page tree

Introduction

The JS7 offers Digital Signing for Workflows and Job Resources that are deployed by JOC Cockpit to Controller and Agents.

The default Signing Certificate that ships with JS7 for releases earlier than 2.5.12, 2.7.6, 2.8.0 will expire on October 12th 2025 at 12:50:55 UTC.

Workflows and Job Resources that have been deployed from earlier JS7 releases using the default Signing Certificate will stop working.

To mitigate the situation users can choose 

  • applying a change that allows continued use of the default Signing Certificate.
  • updating the default Signing Certificate, redeploying Workflows & Job Resources and updating the Daily Plan.

Delimitation

Users are not affected in the following situations:

  • Users operating JobScheduler from earlier releases 1.x.
  • Users who followed the recommendation to create own Signing Certificates are not affected. They manage certificate renewal periods on their own.
  • Users operating JOC Cockpit with the Medium or High Security Levels using own Signing Certificates are not affected for the same reason.

Users are affected in the following situations:

  • Users operating releases 2.x of JS7 JOC Cockpit with the Low Security Level from the default Signing Certificate are affected.

The Security Level can be identified from the JOC Cockpit Dashboard like this:

Mitigation

Users can apply one of the following alternative measures to mitigate the situation.

Applying Change for continued use of default Signing Certificate

A change can be applied from a patch allowing continued use of the existing default Signing Certificate that is available from JS-2219 - Getting issue details... STATUS

Updating the Default Signing Certificate

The related change that brings an updated Signing Certificate is available from JOC-2042 - Getting issue details... STATUS

The procedure is performed directly from JOC Cockpit and is applicable for new orders. To make existing orders continue to work, switch to the previous chapter. 

  • Replacing the default Signing Certificate from a newer certificate.
  • Redeploying Workflows and Job Resources, updating the Daily Plan.

The proceeding will not cause an outage for execution of jobs. It is explained from

Frequently Asked Questions


It is recommended to apply the patch. The following aspects can be considered: 

  • Impact on jobs running in the day
    • Patching Agents impacts running jobs for the period of a few seconds required for restart.
    • Redeploying Workflows and Job Resources does not impact running jobs.
  • Impact on future use of Signing Certificates
    • Without applying the patch, the behavior remains in place that Workflows and Job Resources have to be redeployed on expiration of a Signing Certificate.
    • When applying the patch, Signing Certificates can be used for a longer period.

No, the patch can be applied in any sequence to Controller and Agent instances.

Yes, the patch has to be applied to any Controller and Agent instance.

No, applying the patch is sufficient.

Deleting the patch file and restarting Controller and Agent instances will remove the patch.

No, the patch is included with future updates. When updating Controller and Agent instances, then any previous patches will automatically be removed.

No, we don't. We consider this an opportunity to assist our users. JS7 is designed for security and when certificates are involved, they have to be renewed. Their lifetime is indicated with the user's profile. There is a precise recommendation to use one's own certificates, see Secure Deployment. Some users might not be aware of implications and SOS became aware rather late which is why we offer immediate assistance.

Resources

Contact

Users who wish receiving assistance or asking questions, can get in contact by e-mail to: sales@sos-berlin.com


  • No labels