Centralized JWT Signing Key Management

Key storage and usage

The master domain manager now generates its own proprietary key, which it uses to sign certificates. This key is now centrally stored in the database and is therefore shared between the master domain manager and the backup master domain manager, ensuring business continuity in case you need to switch the manager. When you rotate the certificates on the master domain manager, the old tokens remain valid because the signing key remains unchanged.

The keystore includes a new certificate with the alias mpjwtkey, which contains the server public key (tls.crt). To ensure proper product functionality, this alias must remain unchanged and must not be modified under any circumstances.

Benefits of centralized storage

Centralizing the signing key in the database enables seamless distribution and accessibility across all HCL Workload Automation components. This facilitates secure and uniform token validation throughout the environment.

Key validity and stability

The signing key stored in the database is configured with a validity period of 100 years, ensuring long-term stability and uninterrupted operations across your environment.

Upgrade considerations

If you are upgrading from a previous version, the signing key location is automatically managed by the system. No manual intervention is required—the upgrade process preserves and configures the key as needed.