Cisco ESA issues aggregator

[ExchangeAdmin4285]

Hi since about 11:50 pm January 13 we been getting this error

The Warning message is:

Unable to connect to the Cisco Aggregator Server.

Details: (60, 'SSL certificate problem: unable to get local issuer certificate').

I don't see any messages on status page if I browse directly to that url from.browser of says no certificate sent 

Anyone else run into this issue ?

[janesundh]

Same problem here in Sweden. Both appliance (14.2.1-015 and 14.2.1-020). Started today 14/1 at 05:58 GMT+1.

[Twilhite]

Exact same issue as well for me. Started getting alerts very late on 1/13 (almost midnight) and continued several times an hour all morning. I've since auto ruled them into another folder in my email client and opened a TAC case after finding this thread, telling me it was a more widespread issue. 

I also don't think the VLN issue applies to me either. Both of my appliances are licensed through smart licensing so when running a "showlicense" command, it shows no license installed. That is expected from what I understand when using smart licenses.

[Ken Stieers]

Got this from the Statuspage.io notifications page....  issue has been resolved.

Resolved - 1 component affected - An RFC has been reverted which is now allowing... ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ 

Security: Urgent Notices

2023-01-14-1

Incident resolved An RFC has been reverted which is now allowing for successful connectivity between the ESA and Aggregator

Time posted

Jan 14, 16:46 EST

Components affected

Security Services - Web Interaction T...

View 1 previous incident update

You have received this email because you subscribed to “Cisco Security: Urgent Notices (Email Security)” for Cisco Email Security Appliance (ESA) notifications.

Manage your subscription Powered by Atlassian Statuspage

[janesundh]

Yes, no more error. Working now.
https://urgentnotices.statuspage.io/

[Twilhite]

Same, I no longer get the alerts anymore either.

[UdupiKrishna]

This was indeed due to FN – 72113. Certificate used by aggregator.cisco.com went through a change. Change has been rolled back due to the wider impact - https://urgentnotices.statuspage.io/incidents/j1l52q233rb2

Having said the certificate change will take place in the future for all customers according to the field notice. There are plans being made to avoid manual certificate update.