CSCvo42254 - FPR2100/1000 - FDM does not allow to add CA signed cert for Management Web Server

[bhhenderson]

I'm on 6.6.0 and I am getting this bug.

[JohnHall55161]

How is this fixed. If I am having this issue running 6.6.1

[as75]

I was trying to update my FTD from 7.0.4 to 7.2.5 and the upgrade was always failing with a Java error at about 38% and then reverting back. 

Eventually I discovered that the webserver certificate was expired. Trying to replace the certificate with a CA signed certificate is failing with "SSP server unavailable" error. 

Here is what I have done to fix this.  These steps worked for me in both in 7.0.4 and 7.2.4. You can't replace the webserver certificate with a CA signed certificate but you can replace it with a self signed certificate on the firepower itself.

1. ssh to your firepower (with FDM)

2. go to expert mode

3. sudo su

4. cd /etc/ssl

5. Generate - CSR request

openssl req -new -newkey rsa:2048 -nodes -keyout private.key -out firepower.csr

6. Sign the "self signed" certificate

openssl x509 -req -days 825 -in firepower.csr -signkey private.key -out server.pem

7. Replace the certificate and private key in DefaultWebserverCertificate (firepower/Objects/Certificate in FDM) with the private.key and server.pem generated above. Run these on your firepower and copy the output: cat /etc/ssl/private.key respectively, cat /etc/ssl/server.pem

8. restart the device. After this the upgrade will work.

[qjamil001]

This worked for me. You saved me a lot of time and headache! Thank you!

[Jay Sains]

How do I do step 7?
Step 8 is easy.  

[MHM Cisco World]

https://youtu.be/Exo6HW9c8h0?si=DnXIkio6i1nup_sA

MHM

[Jay Sains]

SSP Server Unavailable.  
Attempted to edit DefaultWebserverCertificate per your instructions.  Attempted to upload CER and Keys to DefaultWebserverCertificate.  Attempted to change DefaultWebserverCertificate.  

Attempts were made after multiple reboots.  Attempts were made after attempting to just restart http.  

I have deregistered and reregistered the firewall with my account.  I was able to update the DefaultInternalCertificate.  Current version is 7.4.2.1-30.  Default web certificate expired over 115 days ago.

[Jose Anda]

I am importing several objects to FTD 1120 - 6.6.1-91 via API Call and I am getting this error:

"statusMessage": "Configuration import failed at step of 'import objects'. Configuration import failed - SSP Server Unavailable\nSSP Server Unavailable",
"scheduleUuid": "d270b736-da16-11eb-9061-d98ad80b9753",
"diskFileName": "ftd1.txt",

[travisr]

I'm running 6.7.0-65 and receiving it as well.

[AlexeyFokanov31798]

Cisco Firepower 1120 Threat Defense (78) Version 6.6.4 (Build 64)

I have the same "SSP Server Unavailable" when replace default cert

[dbullion]

Me Too!!! Anyone found a solution?

[s.balon]

same for me on Cisco Firepower 2120 Threat Defense (77) Version 7.0.4 (Build 55)

[TEST58]

I am having this issue on 7.0.1-84.

[allenh]

Same with 7.2.4.1-43 managed by FDM, SSP Server Unavailable when updating "DefaultWebserverCertificate" 

Has anyone found a solution? 

[as75]

See my solution above. works on 7.2.4.