Migration from SHA-1 to SHA-2 certificates is needed after upgrading to ePolicy Orchestrator

Technical Articles ID: KB87017
Last Modified: 2022-10-20 04:53:32 Etc/GMT

Environment

ePolicy Orchestrator (ePO) 5.10

Summary

This article includes information relating to ePO 5.9.x, but this version is End of Life (EOL). For EOL details, see KB93286 - End of Life for ePolicy Orchestrator 5.9.x.

Problem 1

Browsers flag the ePO console as an unsecure HTTPS, even though the correct certificate is imported into the user certificate store.

Problem 2

A vulnerability scan flags ePO as using SHA-1, which is considered a weak hashing algorithm.

Cause

The SHA-1 algorithm has reached EOL.

Many organizations are deprecating TLS or SSL certificates signed by the SHA-1 algorithm. Browsers such as Google Chrome and Microsoft Internet Explorer are ending support for certificates using SHA-1.

To learn more about SHA-1 support in some browsers, see the following related articles:

Solution

CAUTION: Read the instructions carefully before you continue with the steps. Failure to wait for sufficient agent saturation in step 5 can result in large numbers of agents failing to communicate until the agent is reinstalled.

To remediate vulnerabilities in your ePO environment, migrate your existing SHA-1 certificates to certificates that use the more secure SHA-2 algorithm. A fresh installation of ePO 5.10 installs the latest hash algorithm certificates.

If you upgrade ePO from an older version, migrate the SHA-1 certificates to SHA-2 certificates using the following steps:

Log on to the ePO console as an Administrator.
Click Menu, Configuration, Certificate Manager.

NOTE: The Certificate Manager page provides information about the installed Root Certificate, Agent Handler certificates, server certificates, and other certificates derived from the ePO root Certificate Authority (CA).
Click Regenerate Certificate.
To confirm the certificate generation, click OK.

The ePO root CA and other certificates derived from the root CA are regenerated and stored in a temporary location on the server. The time needed to generate the new certificates varies depending on the number of Agent Handlers and Extensions that derive certificates from the ePO root CA.
Wait for sufficient saturation of the new certificates after certificate regeneration completes BEFORE you continue.

As the agents communicate in their normal agent-to-server communication interval, they're handed a new certificate that uses SHA-2.

NOTE: You can view the certificate distribution percentage in the Product: Agent Handler section of the certificate manager. This percentage gives you information about how many agents have received the newly generated certificates and how many are pending. The distribution percentage is calculated based on the agent-server communication after the certificates are regenerated. This design means that unmanaged clients or clients that are inactive affect the percentage.

IMPORTANT: Before you continue, make sure that the distribution percentage reaches as close to 100% as possible. Otherwise, the pending systems won'’t receive the newly generated certificates and will be unable to communicate with the ePO server after the certificates are activated. You can stay in this state for as long as needed to achieve sufficient saturation.

After you click Activate Certificates, the agents that use the old certificates must be reinstalled to restore agent-to-server communication.

Click Activate Certificates to carry out all future operations using the new certificates after you're satisfied with the saturation of the SHA-2 certificate in your environment.

A backup of the original certificate is created.
Click OK on the warning if you agree to reinstall the agent on any remaining agents that haven't yet communicated and received the new certificate.
Perform the following steps after the certificate activation is complete:
1. Stop the Agent Handler services (including the Remote Agent Handler services).
2. Restart the ePO services.
3. Start the Agent Handler services.
Monitor your environment and make sure that your agents communicate successfully before you finish the migration.

You can cancel the migration at this point to roll back the certificate and restore agent-to-server communication. But, this action isn't possible after you've completed the next step.
Click Finish Migration to complete the certificate migration.

The certificate backup created during activation is deleted.

IMPORTANT:

If you're using a TIE server, you must perform the migration steps listed in the article below after completing this step.

KB88491 - How to reconfigure the Threat Intelligence Exchange Server after ePolicy Orchestrator 5.10 certificate migration (SHA-1 to SHA-2).

If you encounter any issues during the migration process, click Cancel Migration to revert to the previous certificates. If you cancel the migration, you must stop the Agent Handler services, and restart the ePO services and Agent Handler services.

You can start the certificate migration again after you resolve the issues.

Workaround

You can replace the server certificate used by ePO at the console logon screen with one signed by an internal CA or a public CA (such as GoDaddy or Verisign). This action avoids the issue on any version of ePO 5.x. This process only replaces the console certificate, which is associated with port 8443 (by default) and used at the console logon page. It does not change the certificate used for agent-to-server communication, which is associated with port 443 (by default).

For instructions on generating a new console certificate using OpenSSL, see KB72477 - How to generate a custom SSL certificate for use with ePO using the OpenSSL toolkit.

Related Information

Frequently Asked Questions:

What are the consequences of not upgrading to ePO 5.10 and migrating away from an SHA-1 certificate after support for SHA-1 has ended?
Functionally, ePO continues to work as it did before the SHA-1 support was dropped; but, browsers now don't flag the ePO console as a secure HTTPS site.

For some browsers, you might need to add an exception to allow access to the site. For other browsers, the lock icon is open or otherwise displays as unsecure (depending on the browser). Also, vulnerability scanners might flag the ePO server as using an SHA-1 certificate.

Can I migrate my SHA-1 certificate to an SHA-2 certificate if I haven't yet upgraded to ePO 5.10?
Versions of ePO before 5.9.0 use the SHA-1 certificate. SHA-2 support was introduced in ePO 5.9.0 or later.

You can migrate the console certificate (associated with port 8443 by default) to an SHA-2 certificate. But, you can't migrate the handler certificate (associated with port 443 by default) to an SHA-2 certificate unless you upgrade to ePO 5.10.

If I've replaced my console certificate for ePO with a certificate that uses SHA-2, does upgrading ePO overwrite that with another certificate?
No. If you use a custom certificate, the ePO upgrade process leaves the existing certificate in place.

Similarly, if you've replaced the console certificate with one that uses SHA-1, an upgrade to ePO 5.10 does not replace the certificate. In this situation, you must either regenerate a self-signed certificate with ePO 5.10 or replace the certificate using your own CA server or a public CA with a certificate that uses SHA-2.

What if I already completed my SHA-2 migration and discover clients that are still using SHA-1 certificates?
In such cases, perform one of the following actions to restore agent-to-server communication:

Reinstall the Agent on any client that still uses an SHA-1 certificate after you migrate to SHA-2.
Execute the command below:

maconfig -provision -managed -auto -epo <ePO IP> -user <ePO admin username> -password <ePO admin password>

Example:
maconfig -provision -managed -auto -epo 111.111.111.111:8443 -user admin -password epopw

Are there any steps I have to complete after completing the SHA-2 certificate migration?
Yes. If you use a TIE server, you must also perform the migration steps listed in the article below after you complete the migration steps outlined in this document:
KB88491 - How to reconfigure the Threat Intelligence Exchange Server after ePolicy Orchestrator 5.10 certificate migration (SHA-1 to SHA-2)

To receive email notification when this article is updated, click Subscribe on the right side of the page. You must be logged on to subscribe.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Migration from SHA-1 to SHA-2 certificates is needed after upgrading to ePolicy Orchestrator

Environment

Summary

Problem 1

Problem 2

Cause

Solution

Workaround

Related Information

Affected Products

Languages:

Title

Title

Knowledge Center

Migration from SHA-1 to SHA-2 certificates is needed after upgrading to ePolicy Orchestrator

Environment

Summary

Problem 1

Problem 2

Cause

Solution

Workaround

Related Information

Affected Products

Languages:

Choose your region

Title

Title