Unable to upgrade/install Threat Intelligence Exchange 4.x in a multi-ePO environment

Technical Articles ID: KB96447
Last Modified: 2023-06-08 07:26:54 Etc/GMT

Environment

Threat Intelligence Exchange (TIE) Server 4.x

Summary

When you attempt to install or upgrade to TIE 4.x, it might fail to provision certificates on newly added devices.

Problem

We're investigating an issue that presents itself in multi-ePolicy Orchestrator (multi-ePO) environments with bridged Data Exchange Layer (DXL) fabrics connecting multiple ePO servers. In this state, customers might encounter issues with generating certificates for newly installed or upgraded TIE 4.x servers.

This issue can present itself during the initial onboarding of servers, resulting in systems being stuck during the "Waiting for TIE server handshake" portion of the startup wizard.

Customers with this issue might notice the following file is 0 bytes in size:

/var/Trellix/tieserver/keystore/tie_server.p12

The following error might also be present in /var/Trellix/tieserver/logs/tieserver.log:

(SaveAsJksCommand.java:133) - Error generating keyStore or while setting the keyStore entry
java.security.KeyStoreException: Key protection algorithm not found: java.security.KeyStoreException: Certificate chain is not valid

System Change

This issue appears to be limited to installations of TIE 4.x and multi-ePO environments where DXL has been used to bridge the different ePO installations together.

Cause

We're investigating the root cause of this issue.

Solution

We recommend that customers with the ePO and DXL configuration described above upgrade to TIE Server 4.x Hotfix 3 (4.0.0.573).

NOTE: Customers who've attempted to add the servers on the prior builds and failed to ever stand up correctly will need to redeploy those servers on the newer 4.0.0.573 image to add them to the existing installation.

Workaround

This issue seems to present itself when more than one TIE server CA is available in ePO. This occurs as a result of synchronizing CAs across DXL with another ePO server.

You can temporarily remedy this issue by breaking the DXL bridge between the ePO servers and regenerating the TIE server CA on the ePO that's managing the devices you need to issue certificates to. This CA regeneration is covered in KB87743 - How to regenerate Threat Intelligence Exchange Server Certificates and Certificate Authority (CA).

With the DXL bridge in a non-functional state, generating TIE server certificates should work as expected. Make sure that all TIE servers have pulled down new certificates before you restore the DXL bridge.

Affected Products

Threat Intelligence Exchange Server 4.x

Languages:

This article is available in the following languages:

Knowledge Center

Unable to upgrade/install Threat Intelligence Exchange 4.x in a multi-ePO environment

Environment

Summary

Problem

System Change

Cause

Solution

Workaround

Affected Products

Languages:

Title

Title

Knowledge Center

Unable to upgrade/install Threat Intelligence Exchange 4.x in a multi-ePO environment

Environment

Summary

Problem

System Change

Cause

Solution

Workaround

Affected Products

Languages:

Choose your region

Title

Title