Symptoms
On October 11th 2019, the SSL certificate for api.cisco.com has been renewed as the previous one was about to expire. As a result of this change, CSM Image Manager's certificate repository not longer validates the certificate. As a result Image Manager will not be able to download any software images from the Cisco.com files repository until the new api.cisco.com certificate is imported.
This currently affects all CSM versions.
Diagnosis
If you CSM server is unable to communicate with api.cisco.com, the Image Manager may display the following error when trying to update the image listing:
Update failed. Last updated at...
In addition, when trying to download an image from, the list, the following error will be shown:
Failed with Exception
Solution
The certificate store entry for api.cisco.com can be updated with the new certificate by following these steps:
-
Navigate to Tools > Security Manager Administration > CCO Settings.
-
In the Certificates section, remove the api.cisco.com certificate by selecting it from the table and click on Remove.
-
Retrieve certificate by selecting Other, entering "https://api.cisco.com" in the text box and clicking on "Retrieve certificate".
-
On next pop-up screen clink on "Accept"
-
Launch Image Manager and click on check for updates button
on the right hand top corner:
After making these changes, Images should be downloaded without issue, and the Image list should update as expected.
Examples:
Note: This will also affect GeoIP and IPS signature downloads.
More Information
Consult the CSM configuration guide for more information about certificate handling within CSM. https://www.cisco.com/c/en/us/td/docs/security/security_management/cisco_security_manager/security_manager/414/user/guide/CSMUserGuide/syspage.html#31587