Certificate import from a PFX file fails in the 8.11.2 - 8.12.0 console

Products

• Carbon Black App Control

Issue/Introduction

• Updating the server certificate in the 8.11.2 - 8.12.0 web console using a .PFX file fails to apply the new certificate.
• If using the scheduled option, the same old certificate is displayed as both the current and pending certificate.
• The Server Certificate does not change after importing new certificate but the new certificate does appear in Trusted Communication Certificates.
• The following messages may be displayed:

  New certificate was successfully imported and applied. It will be applied in X minutes.
  Error importing certificate: Certificate already exists.

• Agents disconnect/offline after the previous certificate expires. 

Environment

• App Control Server: 8.11.2 - 8.12.0

Cause

A defect in the way the Server swapped the Previous and Current certificates prevented the swap.

Resolution

This issue was fixed with the release of Server 8.13.0 (EPCB-24434) and upgrading will prevent the issue.

Additional Information

• If necessary, the following workaround can be used to swap the certificate
  1. Log in to the application server hosting the Console.
     1. Open the Local Machine Cert Store (certlm.msc)
     2. Navigate to > Trusted People > Certificates
     3. Verify that the new certificate is present
        • If not present, import the Certificate using the .PFX file
  2. In the Console, navigate to: Settings > System Configuration > Security tab
     1. Scroll down to the "Trusted Communication Certificates" section
     2. Verify the new certificate is present
        • If not present, import the Public Key version of the certificate
     3. Copy the Thumbprint of the relevant certificate.
  3. Navigate to https://AppCServer/Shepherd_config.php
     1. Verify the Property, ShowAllProps is set to true
        • If changed, refresh the page.
     2. Locate the Property SSLCertificateThumbprint
        • Change the thumbprint value matches the thumbprint of the new certificate.
     3. Locate the Property PrevSSLCertificateThumbprint
        • Verify the Property Value is empty
  4. On the application server hosting the Console, use the Services Console (services.msc) to restart the Carbon Black App Control Server service.
• PrevSSLCertificateThumbprint only has a value when a Certificate Swap is pending.
  • Any value here would be the Thumbprint of the old certificate, and will be removed after the Update Delay is reached.
  • If no swap is pending, this value should be empty to force the new certificate to be used.
• SSLCertificateThumbprint always has a value which should represent the current Communication Certificate (or a pending one which will be used after the swap).
• Error importing certificate: Could not import cert from temp file