Error: "ERR_BAD_SSL_CLIENT_AUTH_CERT" when logging in to Security Analytics

Products

• Security Analytics

Issue/Introduction

After a recent upgrade from Security Analytics 8.3.1 to 8.4.1, when trying to authenticate using a PIV card (Common Access Card), you get an error, "ERR_BAD_SSL_CLIENT_AUTH_CERT" in the browser.  Logging in directly as a local user is successful.  

Environment

Security Analytics 8.4.1

Cause

There is an expired certificate somewhere in the client certificate bundle.  When looking at the /var/log/httpd/ssl_error_log, this message is found:  "Certificate Verification: Error (10): certificate has expired"

There was an intermediary certificate in /etc/pki/tls/certs/client-ca-bundle.crt that had expired.  Rocky linux, the version that is used in Security Analytics 8.4.1 seems to be more strict with expired intermediary certificates than the linux OS in Security Analytics 8.3.1 (CentOS).

There is another command that can be run from the CLI that will show the expiration dates of all certificates in a bundle.  Run this command as root: 

openssl crl2pkcs7 -nocrl -certfile /etc/pki/tls/certs/client-ca-bundle.crt | openssl pkcs7 -print_certs -text | grep -E "Subject|Not After"

And look for the dates listed next to "Not After : "  If any of those dates are in the past, the certificate is expired.

Resolution

Update the Intermediary Certificate in the client bundle.  Usually these Intermediary Certificates are publicly published and well known.  Once the client bundle has been updated, import the new bundle through the GUI on the Settings > Security page under the PKI and SSL section.  Click the Browse button in the Client PKI Settings section and upload the new certificate file. 

Additional Information