Cookie signing certificate has expired

Description

This alert is triggered when the active Relativity cookie signing certificate on the primary SQL server has expired.

Resolution Guidance

Impact When Active

Relativity uses the cookie signing certificate to sign authentication cookies. When it has expired, users can no longer authenticate to Relativity, and the certificate must be renewed immediately.

How To Resolve

  • Confirm the active certificate and its expiration date on the primary SQL server.
    • Run SELECT Thumbprint, State FROM EDDS.eddsdbo.CookieCertificateState against the primary SQL server. The row with State = 2 is the active signing certificate.
    • Open the Local Computer > Personal certificate store (certlm.msc), or run Get-ChildItem Cert:\LocalMachine\My\<thumbprint> in PowerShell, and check the certificate's expiration date.
  • The cookie signing certificate is created and managed by Relativity. It cannot be replaced with a custom certificate, and it is valid for two years.
  • Renew the certificate by following Updating the Cookie Signing Certificate. When the certificate has expired, the Procuro upgrade deletes the expired certificate and creates a new entry in eddsdbo.CookieCertificateState.
    1. Log in to the primary SQL server with the Relativity Service Account.
    2. Go to the Procuro directory, for example C:\Program Files\kCura Corporation\Relativity\Procuro.
    3. Run kCura.EDDS.Procuro.exe as administrator.
    4. Click Upgrade.
    5. Close the Procuro window.
    6. Wait for the update to finish. Relativity configures a new cookie signing certificate for the environment and invalidates all authentication sessions.
    • Note: Do not use the Update Certificate option in Procuro. That option updates the identity server certificate, not the cookie signing certificate.
  • Warn users that all authentication sessions are invalidated and that they will need to log in again.
  • After the renewal, confirm that EDDS.eddsdbo.CookieCertificateState has a new State = 2 row, and that the new certificate is in the primary SQL server's LocalMachine\My store with an expiration date about two years away.
  • If the problem persists, see the Relativity Community article "How to Renew CookieSigning Certificate", or contact Relativity Support.
  • The alert clears within about 1.5 hours, once the next certificate check reports the new certificate. The certificate check runs every hour, and the alert runs every 15 minutes over a 30-minute window.

Alert Details

The alert is active for the following conditions in Relativity:

  • When the active cookie signing certificate (issued_to is RelativityCookieSigningCertificate) is reported with the installed_expired state.

The Environment Watch agent on the primary SQL server reads the active signing thumbprint (State = 2) from EDDS.eddsdbo.CookieCertificateState every hour. It then reads that certificate from the LocalMachine\My certificate store and reports it through the relsvr.x509_certificate metric.

Alert Condition Details

Name Value
Rule Type Elastic Query
Data View metrics-*
Filter Query relsvr.x509_certificate : * AND labels.relsvr_x509_certificate_issued_to : "RelativityCookieSigningCertificate" AND labels.relsvr_x509_certificate_state : "installed_expired"
Threshold > 0
Time Window 30 minutes
Frequency 15 minutes

Alert Metric Details

Metric Name:

  • relsvr.x509_certificate

Metric Description:

  • This metric reports the X509 certificates that Relativity requires on each server, including the active cookie signing certificate on the primary SQL server. The alert triggers when the cookie signing certificate is reported as expired.

Metric Attributes:

Attribute Name Description
host.name Primary SQL server that reported the certificate
labels.relsvr_x509_certificate_issued_to Certificate subject (RelativityCookieSigningCertificate)
labels.relsvr_x509_certificate_thumbprint Thumbprint of the active cookie signing certificate
labels.relsvr_x509_certificate_state Certificate state (installed_expired)
labels.relsvr_x509_certificate_expired_date_utc Certificate expiration date and time (UTC)
numeric_labels.relsvr_x509_certificate_days_to_expire Number of days until the certificate expires
Feedback