topic Re: Expired Web server certificate preventing upgrade in Network Security

Expired Web server certificate preventing upgrade

Chess Norris — Wed, 12 Mar 2025 09:09:40 GMT

Hello,

I just tried to upgrade a customers FTD via FDM, but got the following error.

Checking this bug - FDM upgrade failure due to HTTPS cert expired they mention we first need to break the H/A before generating and assign the new selfsigned certificate. Is this really necessary? I cannot remember I had to this before when creating and assigning new certificates.

Thanks

/Chess

Re: Expired Web server certificate preventing upgrade

balaji.bandi — Wed, 12 Mar 2025 09:20:37 GMT

Check on the browser certificate, is this expired? (I have not seen this error anytime before)

try a different browser, and see if the complaint is the same?

As per the bug, you may need to fix the issue before you proceed with the upgrade.

Re: Expired Web server certificate preventing upgrade

Chess Norris — Wed, 12 Mar 2025 09:32:47 GMT

Yes, it actually expired today. The FTD's are located far away from where I'm located, so need to be careful and not risking lossing access to the FDM. I'm not really sure what this certificate do, as I'm still able to login to the FDM even though the certificate is expired. If anyone else had this issue, how did you solved it? It's over 200 support cases opend on this bug, so I guess there must be quite alot of peoples with this issue.

THnaks

/Chess

Re: Expired Web server certificate preventing upgrade

steeda — Wed, 12 Mar 2025 19:53:39 GMT

It's a dumb check, but yes if the cert is expired it stops the upgrade.

Suspend, not break, HA on the standby FTD.

Renew the internal cert on the active. Wait for the management int to come back up and verify the cert is in use.

Resume HA on the standby and sync the pair.

Re: Expired Web server certificate preventing upgrade

balaji.bandi — Thu, 13 Mar 2025 07:53:11 GMT

I am sure someone has a workaround, but the best way is to follow the process, renew the cert, and move on.

Until you like to wait for other posters to post any other method or contacting TAC

Re: Expired Web server certificate preventing upgrade

Chess Norris — Thu, 13 Mar 2025 08:41:58 GMT

Quick follow-up. I found another self-signed certificate on the firewall that won’t expire until end of 2028, so I switched to that certificate instead. The upgrade still wouldn’t trigger until I deleted the expired Web Server certificate, but after removing that certificate I was able to start the upgrade.

/Chess