Stealthwatch CA Idendity Certificate

[Barakat]

Hi all,

I have  a problem when I try to update the identity certificate of the Manager to a custom one of my own CA.

When I update it, I loose the connection to the appliance and I get "Config Channel Down"

And according to the documentation, I should remove the appliance through the console. but when I do, I receive this error:

and the operation failed.

what should I do? anybody can help?

Thanks in advance,

[Marvin Rhoads]

What version are you running and what procedure did you follow in your attempt to replace the certificate?

[Barakat]

I have the last version 7.4.2 in virtual platform.

I have received the Certificate from the CA authority containing the info and the URL.

I have added this certificate with CA certificate to the trust store in all the appliance.

Then I replaced it with the self signed one in the identity certificate tab.

I tried to follow the instruction in this file page 73:

https://www.cisco.com/c/dam/en/us/td/docs/security/stealthwatch/certificates/7_4_2_SSL_TLS_Certificates_for_Managed_Appliances_Guide_DV_1_0.pdf

[Marvin Rhoads]

That's the correct procedure. The only thing I can guess is possibly you did not install all certificates in the chain (root, intermediate and issuing CA certificate, as applicable).

If you did that, then I would suggest opening a TAC case. They can guide you through the cli procedure to replace the non-working certificate with a self-signed one and then work with you to determine the root cause for the problem you're experiencing.

[Barakat]

I already added the CA, CA issuing and the cert to the trust store. but as I explained I succeed to open the URL securely

but I lost the connection to the manager (config channel down)

I will see with Cisco.

Thanks a lot

[Barakat · Accepted solution]

The problem was in using a wrong template to create the certificate.

The template should be ((server authentication and client authentication))