Cookie signing certificate will expire within 30 days

Description

This alert is triggered when the active Relativity cookie signing certificate on the primary SQL server is still valid but will expire within 30 days.

Resolution Guidance

Impact When Active

There is no immediate impact. This alert is an early warning that the cookie signing certificate will expire soon. Relativity uses this certificate to sign authentication cookies. If it is not renewed before it expires, the "Cookie signing certificate has expired" alert is triggered and users can no longer authenticate to Relativity.

How To Resolve

  • Confirm the active certificate and its expiration date on the primary SQL server.
    • Run SELECT Thumbprint, State FROM EDDS.eddsdbo.CookieCertificateState against the primary SQL server. The row with State = 2 is the active signing certificate.
    • Open the Local Computer > Personal certificate store (certlm.msc), or run Get-ChildItem Cert:\LocalMachine\My\<thumbprint> in PowerShell, and check the certificate's expiration date.
  • The cookie signing certificate is created and managed by Relativity. It cannot be replaced with a custom certificate, and it is valid for two years.
  • Plan the renewal before the expiration date. The renewal invalidates all authentication sessions, so schedule it in a maintenance window and warn users that they will need to log in again.
  • Renew the certificate by following Updating the Cookie Signing Certificate. For renewing a certificate that has not yet expired, also see the Relativity Community article "How to Renew CookieSigning Certificate", or contact Relativity Support.
    1. Log in to the primary SQL server with the Relativity Service Account.
    2. Go to the Procuro directory, for example C:\Program Files\kCura Corporation\Relativity\Procuro.
    3. Run kCura.EDDS.Procuro.exe as administrator.
    4. Click Upgrade.
    5. Close the Procuro window.
    6. Wait for the update to finish. Relativity configures a new cookie signing certificate for the environment and invalidates all authentication sessions.
    • Note: Do not use the Update Certificate option in Procuro. That option updates the identity server certificate, not the cookie signing certificate.
  • After the renewal, confirm that EDDS.eddsdbo.CookieCertificateState has a new State = 2 row, and that the new certificate is in the primary SQL server's LocalMachine\My store with an expiration date about two years away.
  • The alert clears within about 1.5 hours, once the next certificate check reports the new certificate. The certificate check runs every hour, and the alert runs every 15 minutes over a 30-minute window.

Alert Details

The alert is active for the following conditions in Relativity:

  • When the active cookie signing certificate (issued_to is RelativityCookieSigningCertificate) has 30 or fewer days until it expires, and has not yet expired.

The Environment Watch agent on the primary SQL server reads the active signing thumbprint (State = 2) from EDDS.eddsdbo.CookieCertificateState every hour. It then reads that certificate from the LocalMachine\My certificate store and reports it through the relsvr.x509_certificate metric.

Alert Condition Details

Name Value
Rule Type Elastic Query
Data View metrics-*
Filter Query relsvr.x509_certificate : * AND labels.relsvr_x509_certificate_issued_to : "RelativityCookieSigningCertificate" AND numeric_labels.relsvr_x509_certificate_days_to_expire <= 30 AND NOT labels.relsvr_x509_certificate_state : "installed_expired"
Threshold > 0
Time Window 30 minutes
Frequency 15 minutes

Alert Metric Details

Metric Name:

  • relsvr.x509_certificate

Metric Description:

  • This metric reports the X509 certificates that Relativity requires on each server, including the active cookie signing certificate on the primary SQL server. The alert triggers when the cookie signing certificate has 30 or fewer days until it expires and has not yet expired.

Metric Attributes:

Attribute Name Description
host.name Primary SQL server that reported the certificate
labels.relsvr_x509_certificate_issued_to Certificate subject (RelativityCookieSigningCertificate)
labels.relsvr_x509_certificate_thumbprint Thumbprint of the active cookie signing certificate
labels.relsvr_x509_certificate_state Certificate state, for example installed_expired_warning or installed_expired
labels.relsvr_x509_certificate_expired_date_utc Certificate expiration date and time (UTC)
numeric_labels.relsvr_x509_certificate_days_to_expire Number of days until the certificate expires
Feedback