Update the ABRCA Root CA Certificate on PacketShaper Appliances (Revised: September 16, 2021)
Article ID: 207670
Updated On:
Products
Issue/Introduction
The Appliance Birth Registration Certificate Authority (ABRCA) root CA certificate is the ultimate root of trust for all appliance certificates that Symantec products use. Symantec has created a new ABRCA root CA certificate to replace the one expiring in December 2021. Before the older ABRCA root CA certificate expires, ensure that the new ABRCA root CA certificate is installed on your appliances. The new certificate will have an expiration date of Dec 31 00:04:16 2037 GMT.
When the root CA certificate expires, some features that use the ABRCA root CA certificate for authentication will fail. See the end of this article for additional details.
Warning: The continued operation of your PacketShaper appliances requires that you upgrade Packetshaper and complete the following steps in a timely manner. To ensure the uninterrupted operation of your appliances, request a new appliance certificate and perform a software update by August 31, 2021.
Recovery: What to Do If You Fail to Update Before the Certificate Expires
If you fail to update your PacketShaper appliances before the root CA expires in December 2021, your appliances might experience failures as described in "Consequences of an Expired Appliance Certificate." The steps to renew the certificate are identical, whether you renew the root CA before, or after, the certificate expires. To renew the certificate, follow the steps in this article to upgrade to a new build that contains the updated trust package.
Cause
Resolution
Required Step – Upgrade the PacketShaper OS:
To update the ABRCA root CA certificate, you must upgrade PacketShaper to one of the following supported releases before the date listed in the previous section:
-
PacketShaper 11.10.2.5
-
PacketShaper 11.10.3.4
The new ABRCA root CA certificate is included in these releases. Upgrading to one of these releases automatically updates the ABRCA root CA certificate; no manual action is required. These releases also include a feature which automatically renews the appliance certificate (this is different from the ABRCA root CA) if it is within 60 days of expiring.
For information on upgrading the PacketShaper appliance, see page 325 in PacketGuide 11.9:
Or page 355 in PacketGuide 11.10:
Additional Steps
You must update the appliance certificate in addition to the ABRCA root CA certificate. The system can automatically download the appliance certificate or you can manually force the update of the appliance certificate using the commands described in the next sections.
Access the PacketShaper CLI
Access the PacketShaper CLI using one of the following methods:
- Use an SSH client
- Click the Quick Commands button at the bottom of the Info pages in the PacketShaper user interface
- Use a DB-9 connector to access the serial console
Ensure Access to abrca.bluecoat.com
Ensure that the PacketShaper appliance can access the abrca.bluecoat.com domain, as described in Required Ports, Protocols, and Services for Symantec Enterprise Security Products.
Manually Renew the Appliance Certificate
To manually update the appliance certificate, enter the following commands:
PacketShaper# sys set showdebugCommands 1
PacketShaper# acquire-cert
PacketShaper# sys set showdebugCommands 0
Example:
PacketShaper# acquire-cert
Successfully acquired PacketShaper birth certificate.
Update the Hardware Appliance Certificate in a Closed Environment
If the appliance is in a closed environment, you must do the following to update the appliance certificate:
-
Add a firewall exception for abrca.bluecoat.com.
Verify that You Have Successfully Upgraded Your Appliance Certificate
Enter the following command to show the appliance certificate expiration date:
PacketShaper# ver ver
Example:
PacketShaper# ver ver
Version: PacketShaper 11.10.2.5 build 261254 (DEBUG)
Product: PacketShaper S400
Part Number: xxxxxxxxxx-12345 REV BN
Serial Number: xxxxxxxxxx
Memory: 15.9GB RAM, 4GB System Disk total, 3.1GB System Disk available
mgmt MAC Address: xx:xx:xx:xx:xx:xx
Slot2_in MAC Address: xx:xx:xx:xx:xx:xx
Slot2_out MAC Address: xx:xx:xx:xx:xx:xx
Slot3_in MAC Address: xx:xx:xx:xx:xx:xx
Slot3_out MAC Address: xx:xx:xx:xx:xx:xx
ABRCA root certificate expires Dec 31 00:04:16 2037 GMT
Appliance birth certificate expires May 14 18:32:59 2026 GMT
Installed Keys:
Visibility: Activation 2020-08-12, Expiration Never
Control: Activation 2020-08-12, Expiration Never
FDR: Activation 2020-08-12, Expiration Never
Packet Capture: Activation 2020-08-12, Expiration Never
MaxLinkSize: 2000000000
MaxStaticPartitions: 10000
MaxDynamicPartitions: 20000
MaxClasses: 10000
MaxPolicies: 10000
MaxMatchingRules: 25000
MaxMatchingRulesPerClass: 1000
MaxHosts: 550000
MaxURLCacheEntries: 2000000
MaxConcurrentTCPFlows: 1000000
MaxConcurrentNonTCPFlows: 500000
Consequences of an Expired ABRCA Root CA Certificate
If the ABRCA root CA certificate expires, you will not be able to update the appliance certificate. When the appliance certificate expires, certain appliance-to-back-end communications flows that use the appliance certificate for authentication might stop working correctly, including:
-
Inability to download your license from Broadcom.
-
WebPulse service failure.
Other issues, yet to be identified, might also occur.
Feedback
