Optional security update: OpenJDK

Following the recently disclosed vulnerabilities on eMudhra issued certificates, we have reviewed Nintex RPA and Nintex RPA does not ship or require eMudhra certificates.

However, two third-party components bundled with RPA, OpenJDK and Node.js, have since been updated by their vendors to address the issue. Below are step-by-step guides for upgrading them.

We recommend applying these upgrades as a proactive security measure. Each guide includes validation and rollback steps.

Check your SSL certificate
Besides these upgrades, if you supplied your own SSL certificate during RPA installation, check whether it was issued by an affected eMudhra Certificate Authority. If it was, run the Repair function of the RPA server installer and provide a new certificate.
 

» Refer here for the guide to upgrade Node.js

Upgrade Aerobase OpenJDK 

This guide describes the recommended procedure for replacing the OpenJDK runtime bundled with Aerobase 23.0.7 with a newer build that includes the security fixes for the eMudhra certificate compromise issue. For details of the issue, refer to the OpenJDK security advisory. 

The steps below use Amazon Corretto OpenJDK 17, as Amazon was quick to release a patched version of the OpenJDK. Licensing information is available in the Amazon Corretto FAQs.

• Corretto is distributed by Amazon under an open-source license at no cost. It is licensed under the terms of the GNU General Public License version 2 with the Classpath Exception (GPLv2 with CPE). Amazon does not charge for its use or distribution. 

Check the Trusted Certificates 

• Download the CheckCerts.java utility, which checks the certificates trusted by the Java keystore. Further background is available on the OpenJDK eMudhra page. 

• Open PowerShell as Administrator and run the utility using the Aerobase Java runtime. For example: 

  & "C:\nintex\IDP\Aerobase\Aerobase\embedded\openjdk\jre\bin\java.exe" C:\Temp\CheckCerts.java 

   

• Review the output. The compromised certificates are listed as trusted. 
   

Apply the Upgrade 

1. Download the Amazon Corretto 17 (Windows x64) JDK ZIP archive, which contains the security fixes: amazon-corretto-17-x64-windows-jdk.zip.

2. Open the Windows Services tool and stop the Nintex Server - Authentication IAM Server service. 

3. On the RPA server, navigate to the Aerobase embedded folder, for example:

   C:\nintex\IDP\Aerobase\Aerobase\embedded 

    

4. Rename the existing openjdk folder to openjdk-ORI. This preserves the original runtime for rollback. 

5. Extract the Corretto archive and copy the extracted JDK folder into the embedded folder. Rename the copied folder to openjdk, and rename its inner JDK folder to jre, so that the structure matches the example below. So it should end up as below;

   C:\nintex\IDP\Aerobase\Aerobase\embedded\openjdk\jre

6. Copy the mssql-jdbc_auth-12.2.0.x64.dll from

   C:\nintex\IDP\Aerobase\Aerobase\embedded\apps\mssql  

   into

   C:\nintex\IDP\Aerobase\Aerobase\embedded\openjdk\jre\bin

   This DLL is needed to support SSPI authentication to MSSQL server. 
7. Start the Nintex Server - Authentication IAM Server service. 

8. Re-run CheckCerts.java as described in the previous section. The compromised certificates should no longer be listed as trusted. 

9. Verify that you can sign in to the Aerobase portal, Nintex Admin, Console, Studio and Player (Robot/Assistant). 

Reverting the Upgrade 

If validation fails, restore the previous OpenJDK as follows; 

1. Stop the Nintex Server - Authentication IAM Server service. 

2. Navigate to the Aerobase embedded folder. 

3. Delete or rename the upgraded folder

4. Rename openjdk-ORI back to openjdk. 

5. Start the Nintex Server - Authentication IAM Server service. 

6. Verify that you can sign in to the Aerobase portal, Nintex Admin, Console, Studio and Player (Robot/Assistant).