Payroll SFTP integration fails due to expired certificate-file transfer stopped

ERP Workday
, , , , , , , ,
1

Our payroll file transfers via SFTP integration stopped working on Monday morning. The integration has been running for 18 months without issues, processing biweekly payroll files to our banking partner. Now we’re getting certificate validation errors.

Error from Workday integration logs:


SFTP Connection Failed: Certificate expired
Subject: CN=payroll-sftp.company.com
Expiry: 2024-12-05 23:59:59 UTC

I can see the certificate expired last Thursday, but I wasn’t aware certificates needed renewal. We have no monitoring in place for certificate expiry dates, and now payroll processing is blocked. The SFTP integration configuration in Workday points to our external server with certificate-based authentication.

How do I renew the certificate and update the SFTP integration config? Also need guidance on setting up monitoring so this doesn’t happen again.

system 2

Complete solution covering all three focus areas:

Certificate Renewal Process: The certificate must be renewed on your SFTP server infrastructure first, then updated in Workday:

  1. Generate new certificate on SFTP server (typically 1-year validity)
  2. Ensure certificate includes correct Subject Alternative Names (SANs) for all hostnames
  3. Export public certificate in PEM format without password protection
  4. Test certificate locally using OpenSSL before deploying

SFTP Integration Config Update: In Workday, navigate to: Integration System Security > Edit Integration System

  • Go to SFTP Server Configuration tab
  • Update ‘Host Key’ with new server’s public key fingerprint
  • If using client certificates, upload new cert in Security > Client Certificate section
  • Certificate format requirements:

-----BEGIN CERTIFICATE-----
[Base64 encoded certificate]
-----END CERTIFICATE-----

Include full chain if using intermediate CAs. Click ‘Test Connection’ to validate before saving.

Monitoring Certificate Expiry: Implement three-layer monitoring:

  1. Server-level: Configure automated checks on SFTP server using cron job with OpenSSL
  2. Integration-level: Create Workday scheduled report checking integration system status weekly
  3. Alert thresholds: Set alerts at 90 days (planning), 30 days (urgent), and 7 days (critical)

For Workday-side monitoring, create a custom report:

  • Report Type: Integration Systems
  • Filter: SFTP integrations only
  • Schedule: Weekly email to security and integration teams
  • Include: Integration name, last successful run, certificate expiry (if exposed)

Best practice: Use certificates with 1-year validity and renew at 90-day mark. Maintain a certificate inventory spreadsheet with expiry dates, owners, and renewal procedures. Document the renewal process in your runbook with step-by-step screenshots for future renewals.

For immediate resolution: Upload the new certificate, test connection, then run a test payroll file transfer to validate end-to-end functionality before your next production payroll cycle.

This draft is based on general Workday knowledge. It has not been verified against your specific version and environment. Practitioners: verify the steps and share your experience below.

3

You need to generate a new certificate on your SFTP server first, then update Workday’s integration configuration with the new certificate. The certificate renewal process happens outside Workday - on your server infrastructure. Once renewed, upload the new public certificate to Workday’s SFTP integration settings.

4

For monitoring, we use a certificate expiry scanner that checks all our SFTP endpoints weekly and alerts 30 days before expiration. You can use OpenSSL commands or commercial tools. The key is automating the check so you never miss renewals. Most organizations set 90-day renewal reminders for production certificates to allow time for testing and deployment.

andrewbuilder 5

Confirmed this resolves the issue — regenerating the PEM certificate with correct SANs on our SFTP server, then updating it in Workday’s Integration System Security, restored file transfers immediately.

6

Thanks. Our infrastructure team renewed the server certificate, and I have the new .pem file. Where exactly in Workday do I upload this? I’m looking at the SFTP integration definition but don’t see a clear certificate upload option.

8

Navigate to Integration System > Edit Integration System > SFTP Server tab. You’ll see ‘Host Key’ section where you paste the public key fingerprint. If you’re using certificate-based authentication (not just host key verification), you need to upload the client certificate under Security section. Make sure the certificate format matches what Workday expects - typically PEM format without passphrase protection.

9

Also verify the certificate chain is complete. If your new certificate is issued by an intermediate CA, you need to include the full chain in the PEM file, not just the server certificate. Missing intermediate certificates cause validation failures even with valid certs.

10

Don’t forget to test the integration after updating. Use the ‘Test Connection’ button in the integration system configuration before running actual payroll transfers. This validates the certificate without processing live data.