Update license failing with the CA unknown error

Products

• Messaging Gateway

Issue/Introduction

Symantec Messaging Gateway (SMG) license registration fails with: "Connection error 56: SSL routines::tlsv1 alert unknown ca"

When attempting to register or update a license in Symantec Messaging Gateway (SMG), the registration fails with the following error:

Cannot register the specified license file. Unable to communicate with Symantec to register. Please check your connection settings, and try again. Connection error 56: OpenSSL SSL_read: error:0A000418:SSL routines::tlsv1 alert unknown ca

This may occur even if curl commands to register.brightmail.com and aztec.brightmail.com succeed from the appliance CLI.

Environment

Messaging Gateway

Cause

 This error typically indicates a mismatch or corruption in the local license state or an SSL/TLS handshake failure where the certificate presented during the registration-specific transaction is not recognized by the internal license-control engine.

Resolution

To resolve this issue, you must clear the current license state from the appliance and re-initiate the registration.

1. Log in to the SMG command line interface (CLI) as admin.
2. Remove the current license configuration by running the following command:
   bash

    

   license-control -r -f

   Note: The -r flag removes the license, and -f forces the action.
3. Register the license again using one of the following methods:
   • Online Registration: Use the Control Center UI (Settings > License) to upload the .slf file, or use the CLI:
     bash

      

     register -l [path_to_license_file]

   • Offline Registration: If the appliance continues to have trouble communicating with the registration servers, follow the standard offline registration process to generate a request file and upload the response.

Verify the license status in the Control Center under Dashboard or by running license-control -l in the CLI.

Additional Information

Note that once an appliance has been registered using the standard online method (via the Control Center), the system locks the licensing mechanism to that method. Attempting an offline registration on such a system will result in the error: "This system has previously been registered in the normal fashion. license-control cannot be used on this system."