This issue may occur in one of the following checkpoints:
The issue occurs at “web Host certificate(pb_WebServer)” checkpoint.
Possible cause
- Web Host certificate does not exist or the name is inconsistent with the Master_DomainName in ofcscan.ini or the certificate exists in the certificate store "Untrusted Certificates".
Recommended practices
-
Web Host certificate should be located in the certificate store Personal or Web hosting.
Click the image to enlarge.
-
The name of this certificate can be IP address or hostname or FQDN. It should be the same as 'Master_DomainName' in ofcscan.ini for Apex One server on-premise before version 1141.
If not, do either of the following:
- Re-sign a new certificate with name same as “Master_DomainName” in ofcscan.ini and bundle to IIS. Refer to the KB article: Renewing the IIS SSL certificate of OfficeScan (OSCE).
-
Change the "Server name or IP address" in “Agent Connection Settings” to same as the name of the web Host certificate.
Click the image to enlarge.
Make sure the ip/hostname should be the same as the common name of web Host certificate)
-
If the certificate exists in the certificate store Untrusted Certificates (with same thumbprint as the web host certificate in store Personal or Web hosting), export and backup the certificate then delete the certificate.
Click the image to enlarge.
Possible reason
- The web Host certificate is expired.
Recommended practices
- Renew the certificate. Refer to KB article: Renewing the IIS SSL certificate of OfficeScan (OSCE).
Possible cause
The public certificate of Web Host certificate does not exist or the thumbprint is not the same as the private certificate's.
To resolve the issue:
-
Export the Web host certificate without the private key.
Click the image to enlarge.
-
Import the public key into [Certificate Store]\Trusted People\Certificates\
Click the image to enlarge.
-
Starting from Apex One 2019, new modules in Apex One Security Agent will authenticate whether the communication peer is a valid Apex One server.
Rename the public key (.cer) to "OfcIPCer.dat" and then copy it to {Apex One Server Installation}\PCCSRV\Pccnt\Common\ and overwrite the existing file. This managed key will be deployed to the managed Apex One Security Agents.
For example:
Copy <server_public_key>.cer to {Apex One Server Installation}\PCCSRV\Pccnt\Common\OfcIPCer.dat
Additional information
- Configuring Apex One to use a certificate signed by corporate Certificate Authority
- If the certificate in the agent is inconsistent with the Apex One Server, refer to the KB article: Policy deployment issue due to Web Host Certificate mismatch.