My PMS server cannot download update from WS servers after have renewed third part SSL Certificate

SecurMander

Hi,

My Server Policy Manager Server (v.16.03) cannot communicate with WithSecure’ servers anymore after have renewed a third part SSL certificate.

I have 2 Debian based servers for PMS and PMSP (normal mode). I have used a third part SSL certificate for years but after the latest renew the PMS and PMSP cannot communicate with WS Servers anymore. Clients cannot communicate anymore with PMS et PMSP servers.

When I look at the fspms-download-ws-updates.log, it seems like connection is ok with the messages :

[wsDownloadUpdatesLog] - Connected to url="https://guts2.fsapi.com/q" successfully without a proxy
[wsDownloadUpdatesLog] - Update check completed successfullyNo update is downloaded in any case.

On the client' side I have the error 216 ‘untrusted root ca.’ So this confirm a certificate problem.

Let’s focus on the PMS server for the moment. This is how I use to set my 3rd part SSL certificate :

1. Get my Certificate only cer file
2. Get my Intermediate/Root only cer file
3. I delete the root part of the Intermediate/Root cert, usually the last rows
4. I get the p12 file : openssl pkcs12 -export -out fspms.p12 -inkey fspms.key -in fspms.cer -certfile myserver_at_mydomain_interm.cer -name "fspms"
5. I move the fspms.p12 to the fspms.jks’ folder
6. I import the new trusted certificate : /opt/f-secure/fspms/jre/bin/keytool -importkeystore -destkeystore fspms.jks -deststorepass superPASSWORD -destalias fspms -destkeypass superPASSWORD -srckeystore fspms.p12 -srcstoretype PKCS12 -srcstorepass srcpassword -srcalias fspms
7. Migrate to PKCS12 : /opt/f-secure/fspms/jre/bin/keytool -importkeystore -srckeystore fspms.jks -destkeystore fspms.jks -deststoretype pkcs12
8. Restart fspms : systemctl restart fspms
9. Web test is OK, the SSL certificate is installed but clients fail to update from my PMS and my PMS fails to update from WS servers (still error 216).

The "/opt/f-secure/fspms/jre/bin/keytool -list -v -keystore fspms.jks" command shows me the 3 certificates ( MyServerCertificate – 1st intermediate cert – 2nd Intermediate cert). So it seems like it's ok here ?

I actually use the self signed certificate to get things work but I’d like to find a solution for my 3rd part SSL certificate.

Could you help me to find where the mistake has been made please ?

Thanks.

Sethu Laks

Hi @SecurMander

Thanks for sharing your feedback, I see that you have already raised a support ticket with reference 05xxx179. Our support agent has provided some suggested steps and is awaiting your response. If the issue persists, we recommend replying to the support ticket email so the agent can escalate the matter to our backend team if necessary.