Skip to main content

SMGR TMA000056E Certificate Expiry

Jeremy Boilard

Problem Statement

Avaya Aura System Manager (SMGR) raises alarm TMA000056E with the message "Certificate about to expire on remote element." The affected certificate alias may be `weblm_legacy`, `smmgmt`, or another remote element certificate. Attempts to renew from the SMGR web interface may fail with: "The certificate selected for renewal has not been issued by System Manager's default CA."

Impact

This alarm is typically minor and may not be service affecting. If the expiring certificate is `weblm_legacy` and SMGR is not being used as a standalone WebLM server, the alarm can usually be ignored or suppressed. If SMGR is used as the WebLM host, certificate expiration can affect WebLM connectivity and dependent applications may enter license grace mode. Some renewal methods require a JBoss restart, which makes the SMGR web GUI unavailable for approximately 10–30 minutes and may temporarily affect systems using WebLM on SMGR.

Alarm

TMA000056E

Troubleshooting Steps

  1. Review the active alarm details and identify the certificate alias and element. Typical alarm text is: `TMA000056E Certificate about to expire on remote element` with an alias such as `weblm_legacy` or `smmgmt`.
  2. Check SMGR Trust Management settings to confirm certificate alarm and renewal thresholds: Home > Services > Configurations > Settings > SMGR > Trust Management. The default behavior is to alarm approximately 60 days before expiry and renew approximately 30 days before expiry.
  3. Check Trust Management logs for the alarm and renewal errors. Review `/var/log/Avaya/mgmt/tm/tmTraceLog.log` and `tmAuditLog.txt` for entries containing `TMA000056E`, `Certificate about to expire`, `Renewal of a 3rd party certificate attempted`, or `The certificate selected for renewal has not been issued by System Manager's default CA`.
  4. Verify the `weblm_legacy` certificate validity from the SMGR CLI as root: `keytool -list -keystore $JBOSS_HOME/server/avmgmt/conf/tm/keystore/default_keystore.jks -alias weblm_legacy -v | grep Valid`. If prompted for the keystore password and the environment uses a blank keystore password for this store, press Enter.
  5. Determine whether SMGR is being used as a standalone WebLM server or as the WebLM host for dependent products. If `weblm_legacy` is not used, the alarm may be ignored or suppressed through the supported alarm-management process.
  6. If the alarm is for a Session Manager `smmgmt` certificate, confirm the Session Manager management interface is defined in SMGR Element Manager. In SMGR go to Home > Elements > Inventory > Manage Elements. If missing, add the Session Manager element using its management host address and default values, then commit. After the element exists, use Configure Identity Certificates for the `smmgmt` certificate as described in the applicable Avaya PSN, such as PSN003909u.
  7. If renewal from the web UI fails because the certificate was not issued by the SMGR default CA, do not use Renew. Use Replace for third-party, demo, or legacy certificates that are not issued by the SMGR CA.
  8. Preferred UI method for `weblm_legacy`: In SMGR go to Services > Inventory > Manage Elements. Select System Manager, then choose Configure Identity Certificates. Select `weblm_legacy`, choose Replace, select `Replace this Certificate with Internal CA Signed Certificate`, set key algorithm to RSA and key size to 2048, then commit. In a Geo Redundant deployment, repeat for the secondary System Manager from the primary SMGR as required.
  9. For SMGR 6.3 only, if certificate renewal is expired, stuck, or manual renewal does not update certificate dates, schedule a maintenance window and run the trust initializer as root: `sh $MGMT_HOME/trs/trust_initializer_install.sh -RMIPORT 1399 -HTTPSPORT 443 -TMCONFIGLOC $JBOSS_HOME/server/avmgmt/conf/tm/`. Normal output may indicate that the enrollment password expired and a new temporary enrollment password was set.
  10. After running the SMGR 6.3 trust initializer, verify the new certificate validity: `keytool -list -keystore $JBOSS_HOME/server/avmgmt/conf/tm/keystore/default_keystore.jks -alias weblm_legacy -v | grep Valid`.
  11. Restart JBoss during the maintenance window: `service jboss restart`. Check readiness with `/opt/vsp/twiddle/JBossStatus.sh 1200`. If JBoss is ready after 10–15 minutes but the web GUI is still unavailable, restart PostgreSQL with `service postgresql restart`.
  12. For Geo Redundant SMGR deployments, check Geo Redundancy status after any JBoss restart because replication may be disabled. Re-enable replication from the primary SMGR if required.
  13. If an AES or other dependent application uses SMGR as WebLM host, check the dependent application logs for WebLM SSL or license grace errors. After the certificate issue is corrected and WebLM connectivity returns, confirm the license mode recovers to normal.
  14. Do not use PSN004352u to renew `weblm_legacy`; it is not issued by the SMGR CA and requires a different procedure. Use the applicable Avaya PSN or certificate utility procedure for the installed SMGR version. For SMGR 6.1/6.2, collect certificate validity outputs from the relevant WebLM certificate stores and escalate to Avaya support or the appropriate SMGR certificate subject-matter expert.

Resolution

Resolve TMA000056E by confirming the certificate alias and whether the certificate is actually used. If the `weblm_legacy` certificate is unused, suppress or ignore the alarm through the supported alarm-management process. If the certificate is required, replace non-SMGR-CA certificates instead of renewing them from the SMGR web UI. For `weblm_legacy`, replace it with an Internal CA Signed Certificate using RSA 2048 from Manage Elements > System Manager > Configure Identity Certificates. For SMGR 6.3 cases where renewal is expired or stuck, run the trust initializer, verify the updated validity, restart JBoss, and validate SMGR/WebLM service recovery. For Session Manager `smmgmt` alarms, ensure the Session Manager management interface is present in SMGR Manage Elements before configuring or renewing the identity certificate.