Views:

To fix the issue, perform the following steps:

If it is confirmed that the OSF certificate was replaced by a 3rd-party certificate, do the following:

  1. Remove the the certificate "OfcOSFWebApp" from "Trust People" store and "OfcOSF".
  2. Import the 3rd-party certificate again, and enable "Mark this key as exportable" option.
    For details on importing 3rd-party certificates, refer to this KB Article.

If the OSF certificate was not replaced, the existing cerficate should be removed, and a new set of certificate needs to be generated. Follow the steps below:

  1. Manually delete the certificates:
    • Delete "OfcOSFWebAppRootCA" certificate from "Trust Root".
    • Delete "OfcOSFWebApp" certificate from "Trust People" and "OfcOSF".
  2. Rebuild the certificate with the following command:
    OfcSvcConfig.exe -FuncId InstallOSFCertificate -server_pccsrv_dir_path "C:\Program Files (x86)\Trend Micro\Apex One\PCCSRV" -osf_cert_password trend -apppoolname OfficeScanOSFAppPool -output_file "C:\Windows\OFCMAS1.LOG"
     
    This command will set the password to "trend". It is recommended to change the password value to your preferred password.
     
  1. Open the IIS Manager.
  2. Ensure the setting "Require SSL" is enabled on the following sites.
    • OfficeScan\osfwebapp\
    • OfficeScan\officescan_iac\osf

    SSL Settings

    Click the image to enlarge.

  3. Select Require SSL.
  4. Select Accept under Client certificates.

    SSL Settings_2

    Click the image to enlarge.

  5. Restart IIS service and deploy the policy again to verify the issue.