To fix the issue, perform the following steps:
If it is confirmed that the OSF certificate was replaced by a 3rd-party certificate, do the following:
- Remove the the certificate "OfcOSFWebApp" from "Trust People" store and "OfcOSF".
- Import the 3rd-party certificate again, and enable "Mark this key as exportable" option.
For details on importing 3rd-party certificates, refer to this KB Article.
If the OSF certificate was not replaced, the existing cerficate should be removed, and a new set of certificate needs to be generated. Follow the steps below:
- Manually delete the certificates:
- Delete "OfcOSFWebAppRootCA" certificate from "Trust Root".
- Delete "OfcOSFWebApp" certificate from "Trust People" and "OfcOSF".
- Rebuild the certificate with the following command:
OfcSvcConfig.exe -FuncId InstallOSFCertificate -server_pccsrv_dir_path "C:\Program Files (x86)\Trend Micro\Apex One\PCCSRV" -osf_cert_password trend -apppoolname OfficeScanOSFAppPool -output_file "C:\Windows\OFCMAS1.LOG"This command will set the password to "trend". It is recommended to change the password value to your preferred password.
- Open the IIS Manager.
- Ensure the setting "Require SSL" is enabled on the following sites.
- OfficeScan\osfwebapp\
- OfficeScan\officescan_iac\osf
Click the image to enlarge.
- Select Require SSL.
- Select Accept under Client certificates.
Click the image to enlarge.
- Restart IIS service and deploy the policy again to verify the issue.