"Invalid or expired customer" error connecting with WSS Agent

Products

• Cloud Secure Web Gateway - Cloud SWG

Issue/Introduction

Users accessing internet via Cloud SWG using WSS Agents.

Starting early June, a handful of users started reporting issues connecting to WSS Agent but with time more users started to report this.

The WSS Agent UI would report an "Invalid or expired customer" message, when the license is valid.

Impacted users were running WSS Agent 9.5.6.

A WSS Agent RECONNECT operation or restart of Windows host would not address issue.

"Block legacy CTCv1 communications" option in the Portal -> Connectivity -> Agent settings is enabled

Environment

WSS Agent.

Cause

Cloud SWG update blocking WSS Agent versions under 9.6.1 from connecting when 'Block legacy CTCv1 communications' flag enabled.

Resolution

Two options exist for the time being:

• Upgrade WSS agents to the latest versions as a best practice (or versions 9.6.1 or greater)
• Disable the 'Block legacy CTCv1 communications' on the Portal -> Connectivity -> Agent settings page

Status page announcement highlights this issue, which will be addressed in an upcoming build so that we are consistent with the docs and will allow anything greater than 9.0.65.

Additional Information

The latest patch release for Cloud SWG (started June 2 and completing today), the versions of WSS Agent required for the newer CTC requests is 9.6.1. This does not match what we Cloud SWG documentation (9.0.65+).

This explains why we started seeing issue early June, and it progressively got worse with time.