How to update an expired passive-attack-protection-only keyring

Products

• ProxySG Software - SGOS
• ISG Proxy

Issue/Introduction

The passive-attack-protection-only keyring is generated when the appliance starts for the first time. It is typically tagged to a Device Profile and used for Secure ADN encryption. The certificate has a hardcoded lifetime of 2 years. In SGOS 7.4.15.1 and later, Health Monitoring will trigger a critical alert if this keyring is expired.

Environment

• Edge SWG
• SGOS 7.4.15.1 and higher

Cause

The internal "passive-attack-protection-only" keyring has expired, triggering a new health check alert introduced in recent SGOS versions.

Resolution

This keyring is not used in the production and can be replaced with self-signed certificate.

Option 1: Renew the Certificate directly on the Edge SWG Appliance (SGOS 7.4.16.1 and Later)

To update the validity period or other attributes of an existing private/public keypair for the passive_attack_protection_only_key keyring, ue the following CLI commands:

#(config) ssl
#(config ssl) create certificate passive-attack-protection-only-key 

The CLI will prompt you to enter specific attribute values. Press Enter to accept the default values, ensuring you provide the required Country Code and Common Name. This will generate a new certificate using the existing keypair and update the expiration date. 

Option 2: Management Center script (SGOS 7.4.16.1 and Later)

Create following script and execute it on device:

ssl
create certificate passive-attack-protection-only-key cn x.x.x.x c US state MA

Replace "x.x.x.x" with Edge SWG Management IP.

Note: For automatization Substitution Variables can be used.

Option 3: Manual Update using OpenSSL - If running a version prior to 7.4.16.1, use an external OpenSSL utility to generate a new certificate and import it using the inline keyring command.

This requires access to system with OpenSSL utility installed.

1. Create and edit as desired the "openssl.cnf" file contents below:

   
   

   [ req ]
   distinguished_name = req_distinguished_name
   x509_extensions = v3_ca
   prompt = no
   
   [ req_distinguished_name ]
   C  = US
   ST = California
   L  = San Francisco
   O  = Broadcom Edge SWG passive-attack-protection-only-keyring
   OU = Engineering
   CN = localhost
   
   [ v3_ca ]
   basicConstraints = critical, CA:TRUE

2. Create the private key and certificate:

   
   

   openssl req -x509 -nodes -days 730 -newkey rsa:2048 \
     -keyout private.key \
     -out certificate.crt \
     -config openssl.cnf \
     -extensions v3_ca

3. Merge private key and certificate into single file:

   
   

   cat private.key certificate.crt > inline.txt

4. Update the passive-attack-protection-only-key keyring on the Edge SWG:

   
   

   #conf t
   #(config)ssl
   #(config ssl)inline keyring show passive-attack-protection-only-key --EOF--
       < CONTENTS OF inline.txt file >
   --EOF--

5. Verify that keyring shows new expiration date(Configuration -> Keyrings):

   
   
   

 

Additional Information

If Health Monitoring does not clear Critical alert this may require device restart to reflect the changes.

To update the "Default" keyring, refer to Default keyring reference in the ProxySG's configuration.

If after following the steps above if the health alerts continue contact Broadcom Support.