1. If Apex One server website uses a 3rd party certificate (e,g, a certificate signed by corporate Certificate Authority), please follow Step 6 described in this KB article: Configuring Apex One to use a certificate signed by corporate Certificate Authority.
   1. Move any non–self-signed certificates out of the Trusted Root Certification Authorities certificate store and into the Intermediate Certification Authorities certificate store.
   2. Turn on the Exclusive CA Trust mode on the OS:
      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\Schannel]
      Name: ClientAuthTrustMode
      Type: REG_DWORD Value: 2
2. (Optional) If Apex One Server uses self-signed certificate and is already expired, please follow the steps below to renew Apex One Server web site certificate.
   1. Renew Apex One Server web site certificate.
      1. On the OfficeScan server, open a command prompt.
      2. Go to the \Program Files\Trend Micro\OfficeScan\PCCSRV directory.
      3. Run the following command to add a new certificate to the IIS certificate store:
         svrsvcsetup –GenIISCert
   2. Confirm the renewal of the certificate.
      1. Open the IIS Manager console (inetmgr.exe).
      2. In the IIS Manager, expand the Sites folder and highlight the OfficeScan virtual site.
      3. In the Actions pane, click Bindings... to open the Site Bindings window.
      4. In the Site Bindings window, select type="https" and click Edit.... The Edit Site Binding window will appear.
      5. From the SSL Certificate section, click the Select... button and verify that the certificate expiration date has been extended, or select the certificate with the latest expiration date.
      6. Click OK to close the window.
   3. Remove old web site certificate.
      1. Open the Certificates MMC Snap-In.
      2. Navigate to the Local Computer/Personal store, and find the expired certificate.
      3. Right-click on the certificate, then select Delete.

Make sure the certificates exist and is valid:

• Trusted Root Certificate Authorities > Certificates > OfcOSFWebRootCA

  

• OfcOSF > Certificates > OfcOSFWebApp

  

1. To verify if the steps performed worked, run the command:
   Test “OSFWebApp” > svrsvcsetup.exe -testOSFWebApp
   Result should return HTTP 200 status if issue has been resolved.
2. Re-deploy policies again from Apex Central.

If the issue persists:

• Collect CDT Log by following this KB article: https://success.trendmicro.com/solution/KA-0011430
  • Apex Central Server CDT
  • Apex One Server CDT
• Submit support ticket to Trend Micro Technical Support.