---
title: OTS - Restore Invoice Processing After Certificate Changes
description: "OTS 23.2: Restore Invoice Processing After Certificate Changes"
---
[Skip to content](https://knowledgebase.metasource.com/ots-23.2-restore-invoice-processing-after-certificate-changes#main-content)
[](https://www.metasource.com/)
Open main navigation
Close main navigation
- [Go to Customer Portal](https://clientsupport.metasource.com/tickets-view)
[Go to Customer Portal](https://clientsupport.metasource.com/tickets-view?hsLang=en)
Hello. How can we help you?
- There are no suggestions because the search field is empty.
1. [MetaSource Knowledge Base](https://knowledgebase.metasource.com/?hsLang=en)
2. [OpenText OTS (Output Transformation Server)](https://knowledgebase.metasource.com/opentext-ots-output-transformation-server?hsLang=en)
3. [OTS](https://knowledgebase.metasource.com/opentext-ots-output-transformation-server?hsLang=en#ots)
# OTS - Restore Invoice Processing After Certificate Changes
## OpenText Output Transformation Server (OTS) CE 23.2 integrating with AppEnhancer 22.2 through its REST API has failed export between the two components.
**Versions:**
23.2+
**Symptoms:**
You may encounter the following combination of symptoms:
- Invoice files fail to import into AppEnhancer.
- The AppEnhancer website opens successfully in a browser, but OTS processing still fails.
- AXLoader logs report `SSLHandshakeException: PKIX path building failed` or `unable to find valid certification path to requested target` while retrieving the AppEnhancer application ID.
- Processing remains idle after SSL recovery because the invoice file-event service is stopped.
- Processed files remain in the input location and expected archive output is absent because the cleanup service is stopped.
A hostname/subject-alternative-name mismatch also appeared during the investigation. Treat that message as a separate diagnostic finding rather than assuming every certificate error has the same cause.
**Confirmed causes:**
The final technical recap identified two areas requiring correction:
1. **Outdated OTS certificate stores and configuration.** The website certificate had already been replaced, but the OTS Java trust store still contained previous certificate information. Java trust validation failed during AppEnhancer REST calls, preventing application-ID lookup and audit-file setup.
2. **Stopped OTS services.** The invoice file event required startup before processing resumed. A separate stopped file-cleanup service prevented archiving after processing was restored.
**Before you begin:**
- Arrange an approved maintenance window and involve your OTS/application administrator. Certificate-store changes and service restarts should be reviewed for your environment.
- As a precaution, back up the existing certificate stores and affected configuration files before changing them.
- Identify the current production certificate, the stores OTS actually uses, their formats, and the associated configuration references. Do not select an older certificate simply because it remains installed.
- Protect exported private keys and store passwords.
- Use the version-specific documentation or Technical Support for exact paths, commands, and password settings.
**Resolution:**
##### 1. Confirm the SSL failure in OTS logs
Review the AXLoader and Tomcat logs for the trust-validation errors above. Confirm whether the failure occurs when OTS calls the AppEnhancer REST API to retrieve the application ID. Distinguish a trust-path failure from a hostname mismatch before choosing the corrective action.
##### 2. Update the OTS certificate stores
These steps may require assistance from customer's IT team:
1. Select the current production certificate in Windows Certificate Manager.
2. Export that certificate with its private key and extended properties to a password-protected PFX/PKCS#12 file. The session used 256-bit encryption.
3. Use KeyStore Explorer to import the PFX key pair into the OTS keystore under the lowercase `tomcat` alias.
4. Preserve the obsolete trust store for rollback, then create a replacement OTS trust store and import the current certificate using `keytool` under administrator/support guidance.
5. Verify the certificate being trusted before accepting the import.
**Format caution:** If the keystore uses a JKS-style filename but is treated as PKCS#12, confirm the actual format rather than inferring it from the filename. Do not assume the same format or naming applies to every installation.
##### 3. Align configuration references and restart
Review the configuration locations used in the case:
- **Tomcat environment batch file:** confirm the trust-store path, type, and password reference.
- **`server.xml`:** align keystore and trust-store password entries with the regenerated stores.
- **Process Designer `startup.properties`:** align the trust-store path, password, and type in the startup/JVM configuration where applicable.
After saving the reviewed changes, stop and restart Apache Tomcat. You may also reboot the OTS server; whether that is necessary in another environment requires administrator review. Check newly generated logs before proceeding.
Do not disable certificate or hostname validation as a workaround.
##### 4. Restore the required processing and cleanup services
1. Confirm Apache Tomcat is running and OTS Manager can connect.
2. Identify and start the file event that submits invoice jobs. Example: If the name was `Invoices/Get Invoices.xFileEvent`; use the corresponding deployment in your environment.
3. Allow for console refresh delay and verify the service reaches its started state.
4. Confirm invoice processing resumes before investigating residual cleanup behavior.
5. If processed files are not archived, check the file-cleanup service in OTS Manager and start it if stopped.
6. Review autostart settings for the services required by your deployment. Try enabling autostart for all OTS Manager services in the source environment; do not apply that scope elsewhere without confirming which services should run.
**Validation and Escalation:**
Validate the full workflow, not only service startup:
- Tomcat starts without the original SSL trust failure, and OTS Manager connects.
- Invoice files move through processing; output index/ASCII files and successful audit output are created.
- A corresponding document/index record is present in AppEnhancer.
- Previously queued files are processed.
- The Tomcat `all-debug` log shows folders being archived after the cleanup service starts.
If trust errors persist, provide Technical Support with sanitized error excerpts, store formats, configuration references, and service states. Investigate any hostname/SAN mismatch separately.
**Related documentation:**
The support team supplied these OpenText references. Access may require an OpenText support account.
- [Output Transformation Server CE 23.2 User Guide — KB0789408](https://support.opentext.com/csm?id=kb_article_view&sysparm_article=KB0789408)
- [Output Transformation Server CE 23.2 Developer’s Guide — KB0789410](https://support.opentext.com/csm?id=kb_article_view&sysparm_article=KB0789410)
- [Output Transformation Server Manager CE 23.2 Administration Guide — KB0789414](https://support.opentext.com/csm?id=kb_article_view&sysparm_article=KB0789414)
- [Embedded Output Transformation Engine CE 23.2 User Guide — KB0789004](https://support.opentext.com/csm?id=kb_article_view&sysparm_article=KB0789004)
- [Tungsten (Kofax)](https://knowledgebase.metasource.com/tungsten-kofax?hsLang=en#main-content)
- [Installation and Setup](https://knowledgebase.metasource.com/tungsten-kofax?hsLang=en#installation-and-setup)
- [Troubleshooting](https://knowledgebase.metasource.com/tungsten-kofax?hsLang=en#troubleshooting)
- [Updates](https://knowledgebase.metasource.com/tungsten-kofax?hsLang=en#updates)
- [OpenText AppEnhancer (ApplicationXtender)](https://knowledgebase.metasource.com/opentext-appenhancer-applicationxtender?hsLang=en#main-content)
- [Installation and Setup](https://knowledgebase.metasource.com/opentext-appenhancer-applicationxtender?hsLang=en#installation-and-setup)
- [Basic Features](https://knowledgebase.metasource.com/opentext-appenhancer-applicationxtender?hsLang=en#basic-features)
- [Troubleshooting](https://knowledgebase.metasource.com/opentext-appenhancer-applicationxtender?hsLang=en#troubleshooting)
- [Updates](https://knowledgebase.metasource.com/opentext-appenhancer-applicationxtender?hsLang=en#updates)
- [System Requirements](https://knowledgebase.metasource.com/opentext-appenhancer-applicationxtender?hsLang=en#system-requirements)
- [Security](https://knowledgebase.metasource.com/opentext-appenhancer-applicationxtender?hsLang=en#security)
- [OpenText Intelligent Capture (Captiva)](https://knowledgebase.metasource.com/opentext-intelligent-capture-captiva?hsLang=en#main-content)
- [Installation and Setup](https://knowledgebase.metasource.com/opentext-intelligent-capture-captiva?hsLang=en#installation-and-setup)
- [Troubleshooting](https://knowledgebase.metasource.com/opentext-intelligent-capture-captiva?hsLang=en#troubleshooting)
- [PaperVision](https://knowledgebase.metasource.com/papervision?hsLang=en)
- [OpenText OTS (Output Transformation Server)](https://knowledgebase.metasource.com/opentext-ots-output-transformation-server?hsLang=en#main-content)
- [OTS](https://knowledgebase.metasource.com/opentext-ots-output-transformation-server?hsLang=en#ots)
- [FileBound](https://knowledgebase.metasource.com/filebound?hsLang=en)
[](http://www.metasource.com)
[getsupport@metasource.com](mailto:getsupport@metasource.com)
[(888) 634-7684](tel:18886347684)
© 2025 MetaSource, LLC. All rights reserved.