Service "Certificate Expiration Checker" send empty emails

[tlull]

Hello,
I'm currently runnig EJBCA 8.2.0.1 Community.
The service of type "Certificate Expiration Checker" sometimes sends empty notification emails (no subject, no body).
The notification configuration contains a subject and a message. The message utilizes the following variables: ${CN}, ${expiringCert.CERTSERIAL}, ${expiringCert.CERTSUBJECTDN}, ${expiringCert.EXPIREDATE}
What could be the problem?
The same service has been running for many years without this issue.

Kind regards,
Torsten

[primetomas]

There should be something logged in the log file if message sending fails. Do you have log entries for successful and failed mail?
If there is an exception sending email you should have this in the log:

Error sending notification to user {0} with email {1}.
(with {0} and {1} being replaced by real valued of course)
You can also see "Missing e-mail recipient", or some other things.

Nothing has changed in the "interpolation code" for 8 years what I can see, it uses regexp to replace the $ things.

Debug logging of the specific class org.ejbca.util.mail.MailSender should print a lot of details...

[tlull]

Hello Tomas,
thanks for your investigations.
This night the described behaviour appeared again. It sends several empty emails. The log entries look as follows:

2024-06-04 04:13:52,616 INFO  [org.ejbca.core.model.services.actions.MailAction] (EJB default - 1) Email Notification was sent to XXXX successfully.
2024-06-04 04:13:52,617 INFO  [org.cesecore.audit.impl.log4j.Log4jDevice] (EJB default - 1) 2024-06-04 04:13:52+02:00;ACCESS_CONTROL;SUCCESS;ACCESSCONTROL;CORE;ServiceSession;;;;resource0=/ca/1192974216
2024-06-04 04:13:52,620 INFO  [org.cesecore.audit.impl.log4j.Log4jDevice] (EJB default - 1) 2024-06-04 04:13:52+02:00;CERT_CHANGEDSTATUS;SUCCESS;CERTIFICATE;CORE;ServiceSession;1192974216;71794EB0E3BF036F;XXXX;msg=Set status on certificate for username 'XXXX', fp=3ef7e5ef3af7a9fc1fdbd85ddb20620d343fe9af, status=21, subjectDN 'E=XXXX,CN=....,C=DE', serialNo=71794EB0E3BF036F.

A moment before sending all the empty emails the following exception has been added to the log file:

2024-06-04 04:13:52,532 INFO  [org.ejbca.core.ejb.services.ServiceSessionBean] (EJB default - 3) Service MailCertificateExpirationUser execution failed.: org.ejbca.core.model.services.ServiceExecutionFailedException: javax.ejb.EJBTransactionRolledbackException: javax.transaction.RollbackException: ARJUNA016053: Could not commit transaction.
        at deployment.ejbca.ear//org.ejbca.core.model.services.workers.EmailSendingWorker.sendEmails(EmailSendingWorker.java:79)
        at deployment.ejbca.ear//org.ejbca.core.model.services.workers.CertificateExpirationNotifierWorker.work(CertificateExpirationNotifierWorker.java:215)
.....
Caused by: org.hibernate.StaleObjectStateException: Row was updated or deleted by another transaction (or unsaved-value mapping was incorrect) : [org.cesecore.certificates.certificate.CertificateData#3a73615d4ae03167fefabc9ef5dcb263ee34a772]
        at org.hibernate@5.3.28.Final//org.hibernate.persister.entity.AbstractEntityPersister.check(AbstractEntityPersister.java:2541)

Can this information help you?
Or should I increase the log level for sending emails and provide you with more information?

Kind regards,
Torsten

[tlull]

It seems so, that I have found the problem. In our system there are 2 cert expiration checker services, one for notifying users and one for notifying administrators for system certificates. The expiration checker service for administrators lost all its configurations, including the email text and the restriction just to send to the admin address. So it starts to send empty emails to users too.

I have no idea, when it has lost its configuration. Maybe that happend during an upgrade.

Thanks for your support,
Torsten

[primetomas]

Great to know. Thanks for posting the resolution here for others.

Cheers,
Tomas