FPR1010 FDM Certificates Expired change in behavior for upgrades

[Michael King]

Due to the Semiannual Security Advisory released yesterday we are testing upgrading to 7.4.2.1 from 7.4.2.

We've run into a problem that the upgrade is throwing errors that expired certificates "exist"

The DefaultWebserverCertificate was replaced by a new one when we upgraded to 7.4.2.  On one of our test boxes, the DefaultInternalCertificate was still valid, so we experimented by deleting the DefaultWebserverCertificate, and the upgrade was allowed to continue.  So even though DefaultWebserverCertificate is not in use, it's blocking the upgrade.

So I have two questions.

1. For a FDM managed FPR-1010, is it safe to just delete the DefaultInternalCertificate?  (The only reference I can find is it's used for FMC communication).

2. Is there a plan to document this anywhere?  Field Notice, a note on the https://www.cisco.com/c/en/us/support/docs/security-vpn/public-key-infrastructure-pki/215850-certificate-installation-and-renewal-on.html page, Release notes, something?  

[Aref Alsouqi]

That behaviour you are seeing is very similar to ISE upgrade. If you have an expired certificate and even if that certificate is not used ISE upgrade will fail and as a pre-req we have to go and delete all the expired certificates before going ahead with the upgrade. So, it is safe to remove any unused expired certificate, actually it is a best practice to not have any expired certificate on any production appliances.