Expired Web server certificate preventing upgrade

[Chess Norris]

Hello,

I just tried to upgrade a customers FTD via FDM, but got the following error.

Checking this bug - FDM upgrade failure due to HTTPS cert expired they mention we first need to break the H/A before generating and assign the new selfsigned certificate. Is this really necessary? I cannot remember I had to this before when creating and assigning new certificates.

Thanks

/Chess

[balaji.bandi]

Check on the browser certificate, is this expired? (I have not seen this error anytime before)

try a different browser, and see if the complaint is the same?

As per the bug, you may need to fix the issue before you proceed with the upgrade.

[Chess Norris]

Yes, it actually expired today. The FTD's are located far away from where I'm located, so need to be careful and not risking lossing access to the FDM. I'm not really sure what this certificate do, as I'm still able to login to the FDM even though the certificate is expired. If anyone else had this issue, how did you solved it? It's over 200 support cases opend on this bug, so I guess there must be quite alot of peoples with this issue.

THnaks

/Chess

[steeda · Accepted solution]

It's a dumb check, but yes if the cert is expired it stops the upgrade.

Suspend, not break, HA on the standby FTD.

Renew the internal cert on the active. Wait for the management int to come back up and verify the cert is in use.

Resume HA on the standby and sync the pair. 

[balaji.bandi]

I am sure someone has a workaround, but the best way is to follow the process, renew the cert, and move on.

Until you like to wait for other posters to post any other method or contacting TAC

[Chess Norris]

Quick follow-up. I found another self-signed certificate on the firewall that won’t expire until end of 2028, so I switched to that certificate instead.  The upgrade still wouldn’t trigger until I deleted the expired Web Server certificate, but after removing that certificate I was able to start the upgrade.

/Chess