Steps to Reproduce

1. Update a Pega Platform environment to Pega Platform '23.1.5 or ‘24.1.5. 
2. Perform search and observe that results are not retrieved.
3. Check the status of pyFTSIncrementalIndexer Queue Processor.   
   • Result:  It is in Not running state. 
4. Fetch the shard details using steps discussed in How to gauge the health of the Elasticsearch cluster and shards.   
   • Result: The following error is displayed: Can't retrieve Cluster Shards Info. 

Root Cause

The issue is related to the Elasticsearch node's SSL certificate not containing a valid Subject Alternative Name (SAN) or Common Name (CN) that matches the configured hostname or IP address, which is causing the SSL handshake to fail upon Tomcat restart following the patch application.  

Recently Pega plaform io.netty jars were upgraded from version 4.1x to 4.2x as part of Pega’s proactive security strategy.  In the updated version, hostname and IP address validation have become mandatory, which is not currently supported by the out-of-the-box Pega search Elasticsearch certificates.  

The errors are only seen by users running Embedded Elasticsearch, which has been deprecated and replaced with externalizing search via the Search and Reporting Service (SRS). 

Solution

To support a safe and well-supported route to Pega Platform '23.1.5 or 24.1.5 follow the steps below. These are the  keytool Commands to generate es-keystore.jks and es-truststore.jks 

To generate the keypair, add comma-separated IP addresses or DNS names of all nodes that form the cluster with the search nodes (web node, background/batch node, and search node). 

Steps to Generate es-keystore.jks and es-truststore.jks 

1. Generate Keypair 

Use the following command to generate a keypair: 

keytool -genkeypair -alias es-cert -keyalg RSA -keysize 2048 -validity 3650 -keystore es-keystore.jks -storepass <PASSWORD> -keypass <PASSWORD> -dname "CN=<FQDN>, OU=<ORG_UNIT>, O=<ORG>, L=<CITY>, ST=<STATE>, C=<COUNTRY_CODE>" -ext SAN=dns:<FQDN>,dns:<SHORTNAME>,dns:*.example.com,ip:<IP_ADDRESS> 

Sample Command: 

keytool -genkeypair -alias es-certlatest -keyalg RSA -keysize 2048 -validity 3650 -keystore es-keystore.jks -storepass <password> -keypass <password> -dname "CN=PegaSystems Worldwide Limited, OU=PegaSystems Worldwide Limited, O=PegaSystems Worldwide Limited, L=Hyderabad, ST=Telangana, C=IN" -ext SAN=dns:xxxxx.rpega.com 

2. Convert JKS to PKCS12 

keytool -importkeystore -srckeystore es-keystore.jks  -destkeystore es-keystore.jks -deststoretype pkcs12 

3. Export Certificate 

keytool -exportcert -alias es-cert -file es-cert.crt  -keystore es-keystore.jks -storepass <PASSWORD> 

4. Import Certificate into Truststore 

keytool -importcert -alias es-ca -file es-cert.crt -keystore es-truststore.jks -storepass <PASSWORD> -noprompt 

Result : es-keystore.jks and es-truststore.jks will be generated successfully. 

Steps to Update Keystore and Truststore in DevStudio 

1. Login to DevStudio. 
2. Navigate to: Records → Security → Keystore. 
3. Open es-keystore.jks. 
4. Click Upload, select the latest es-keystore.jks file, and click Save. 
5. Repeat the same steps for es-truststore.jks:  
   1. Open es-truststore.jks. 
   2. Upload the latest file and click Save. 
6. Restart all nodes after performing the above changes to apply the updates.

Reference

Pega Platform Infinity 23.1.5 Installation and Update Information  

Pega Platform Infinity 24.1.5 Installation and Update Information  

Pega Platform 24.1.5 Patch Update Impact 

Existing known issues

Security Bulletin: Vulnerabilities in netty-codec-4.1.124.Final.jar, netty-codec-http-4.1.108.Final.jar, netty-codec-http2-4.1.124.Final.jar affecting MongoDB Enterprised Advanced (CVE-2025-58057) ? 

pyFTSIncrementalIndexer not running or turning off automatically 

How to gauge the health of the Elasticsearch cluster and shards