TLS Certificate is due to expire (GlobalSign) 4

[tac84]

Hi all,

Is anyone starting to receive TLS Certificate warnings for the 'GlobalSign' trusted certificate, due to expire on 15 December 2021? I couldn't see anything on the support page and this alarm has only just appeared.

I know how to delete a certificate but would this be the correct solution or should I hold off until Avaya put something out?

[R11.1 Feature Pack 1, Service Pack 1]

Cheers

Thanks, Tim
Adelaide, Australia

 

[tac84]

For those playing along at home, apparently I'm the first person in the whole wide world to alert Avaya to this and they now will work on a solution.

"Currently the latest status is to fix the issue in FP2 but not yet decided. I do believe we will have a solution published before the certificate expired as all of global IPO system will have the same issue."

Unbelievable.

Thanks, Tim
Adelaide, Australia

 

[BFG9K]

Classic Avaya. This has happened plenty of times before.

 

[JoConnex]

They already have a solution fot the 2 certificat. verisigh and lets encrypt.

https://support.avaya.com/ext/index?page=content&id=SOLN356197

I can send you both certificat to updload if you need.

Good luck

Jo the quebec tech
AIPS,ACSS,APSS

 

[tac84]

Hi @JoConnex - yes aware of those two solutions but this alarm is for the GlobalSign certificate which will now start alerting on everyone's systems.
I know how to delete a certificate but lodged a ticket anyway with Avaya to ensure that's the best course of action to take, or if they have an alternative.

Thanks, Tim
Adelaide, Australia

 

[tac84]

Update posted by Avaya's support site:

https://support.avaya.com/ext/index?page=content&id=SOLN366193&viewlocale=en_US

Solution-
Fixed in 11.1 FP2 (from JIRA IPOFFICE-167937)

Workaround to remove expired certificate
and optionally, add the GlobalSign cert if you need this TLS certificate,


PROCEDURE:
STEP 1: Downloaded the attached ZIP file (at the bottom of this article) and extract the 2 cert files:


Delete-GlobalSign.pem
Add-Root-R3.pem


STEP 2: Copy the files using WebManager | File Manager

Copy the file Delete-GlobalSign.pem to the delete folder: /system/primary/certificates/tcs/delete/
(Optionally) Copy the file Add-Root-R3.pem to the add folder: /system/primary/certificates/tcs/add/


Use Web Manager | File Manager to upload the cert to the appropriate folder/directory.
(Does not work with Manager | Embedded File Manager)

For Secondary server, click on "Select Another System" and select the node you need, then copy the files to the delete or add folders.
For 500v2, you will need to place the certificates in the SD card TEMP folder, and from there, move to the delete or add folders.



Finally, after the certificates are copied, reboot the IP Office service (Linux Systems) or the IP Office (500v2)


Thanks, Tim
Adelaide, Australia

 

[BFG9K]

Cheers Tim! Waiting for the next cert to expire so we can do this all over again.

 

[tac84]

@BFG9K Isn't Avaya just wonderful....


Thanks, Tim
Adelaide, Australia

 

[Westi]

What is this specific certificate used for?

I can't find anything they use this certs for.

Does anyone know?

Joe
FHandw, ACSS, ACIS

"Dew knot truss yore Spell Cheque

 

[derfloh]

@Westi

Doesn't matter... From December 15th in, they will not use it anymore for sure

IP Office remote service
IP Office certificate check
CLI based call blocking
SCN fallback over PSTN

 

[teletechman]

Anybody have this download, it is not working from the kb. I need to delete this from a system and can't find it.
Mike

 

[BFG9K]

Hey Mike, see attached

Cheers,
BFG9K
Avaya IPO/ACCS Technician
Melbourne, Australia

 

[teletechman]

Thank you