Thoughts on Certificate about to expire (60 day warning)- DST Root CA X3 2

[tac84]

Hi everyone,

This Certificate is due to expire on 17 March 2021. Does anyone know if it will automatically renew?

IPO Essential Edition R11.0.4.3

See the below screenshots:

Any thoughts would be greatly appreciated.



Thanks, Tim
Adelaide, Australia

 

[derfloh]

Not automatically. Perhaps with the next service pack.

IP Office remote service
IP Office certificate check
CLI based call blocking
SCN fallback over PSTN

 

[tac84]

Thanks @derfloh. I'm trying to get hold of 11.0 Feature Pack 4, SP4 or SP5 Admin as for some reason my Support/PLDS access won't let me download them, so I've lodged a ticket with Avaya to get this fixed.

Thanks, Tim
Adelaide, Australia

 

[derfloh]

Curious what they will tell you. I guess they will ask you to update

You can disable this warning. It was the same as with another certificate in the past.

https://support.avaya.com/knowledge/public/solutions/SOLN346495.html

IP Office remote service
IP Office certificate check
CLI based call blocking
SCN fallback over PSTN

 

[tac84]

@derfloh I'm not looking forward to it. I've had an active ticket for a while because I'm having trouble accessing certain downloads from support.avaya.com, such as the latest Service Packs 4 & 5 and they're scratching their heads trying to work it out.

Can't even download the Certificate (404 message) to try and delete it using the old trick of uploading it the right folder on the SD Card then rebooting...

Thanks for the link but the full article is no longer available.

Will let you know how I go.

Thanks, Tim
Adelaide, Australia

 

[tac84]

Hi all,
An update on this one.

Decided to update to 11.0.4 Service Pack 5 (Just released) - The security certificate due to expire is still on the device, along with another one that's due to expire later this year too.

I can download the GlobalSign (First one highlighted) which means I could remove it by placing it in the correct folder on the SD card then rebooting, however I can't download the DST Root CA X3 certificate from Web Manager due to a 404 error when attempting to download the certificate.

After upgrading to Service Pack 5, I formatted the SD card with Manager and rebuilt, added my config and PLDS licences to start fresh but the above issues remain.

I do have the Admin software for 11.1 GA (Not the service packs 1 & 2) so could potentially upgrade further however it doesn't appear to be removing the expiring certificates.

Any ideas? Obviously ignoring the 60 day warning system alarm but it's annoying me because I can't fix it!

Thanks

Thanks, Tim
Adelaide, Australia

 

[janni78]

The Let's Encrypt certificate can be downloaded from this support article

[URL unfurl="true"]https://support.avaya.com/ext/index?page=content&id=SOLN356197&viewlocale=en_US[/url]



"Trying is the first step to failure..." - Homer

 

[tac84]

Thanks for the link @Janni78 - Unfortunately when I click on the link and sign in using my SSO, I get a message saying: "The article was not found, or is no longer available"


Thanks, Tim
Adelaide, Australia

 

[janni78]

That's odd, it works for me

Try searching for SOLN356197 or download the cert from [URL unfurl="true"]https://support.avaya.com/public/downloadFile.jsp?file=/resources/sites/AVAYA/content/live/SOLUTIONS/356000/SOLN356197/en_US/Lets%20Encryt%20Cert.zip[/url]

"Trying is the first step to failure..." - Homer

 

[tac84]

Thanks @Janni78. My SSO login is playing up big time at the moment that would be the problem. Appreciate the link.

I'm assuming I just delete this the normal way uploading to the system/primary/certificates/tcs/delete folder on the SD card as the certificate is no longer required?

Thanks, Tim
Adelaide, Australia

 

[tac84]

FYI this is now resolved thanks to the info from @Janni78 plus the above method of deleting certificates on IPO.

Thanks for everyone’s input.

Thanks, Tim
Adelaide, Australia

 

[sonicky]

Hi @tac84, May i ask the step for resolved this issue, Could you please advise.

The step to delete need to download the Lets Encryt Cert.der from above link and add to primary/certificates/tcs/delete folder ?

Not meaning deleting form WebManager | Security | Trusted Certificate Store ?

 

[tac84]

Hi @Sonicky
I posted the instructions on how to remove the expired certificate in another thread. See this link:

https://www.tek-tips.com/viewthread.cfm?qid=1808314

Thanks, Tim
Adelaide, Australia

 

[sonicky]

Hi @tac84

Thank you for your advise.