9.5.2: Change of certificate does not work (bug?)

Hi TillLober 

Would you please confirm that the new/old SSL certificate follows the requirement mentioned in this article which requirement from Apple for iOS 13 and macOS Catalina?

Please refer to this article from Sophos on these requirements and follow steps.

In reply to Jasmin:

Hi there!

I can confirm the same problem here. We updated to Version 9.5 and renewed our SSL/TLS certs. After this, my client devices get the 2033 sync error...

Regards

Chris

In reply to Christoph Bucher:

I purchased like always and never had problems. I checked my cert and there is nothing what is not supported - I think the cert cache within the App-Server has problem.

I‘m looking forward for a fix.

Thank you!

In reply to TillLober:

Hi TillLober 

I am assuming that you have followed this article, could you please let me know which certificates are displayed in the certificate list of TLS/SSL tab of Mobile control server? Are you able to enroll any new device after renewing the certificate? Can you try to synchronize the devices on the server, and check the task status? I will be discussing this with our support team, and let you know if we can get more information related to this issue. 

Hi Folks

Our SSL certificate is presented like this in the SSL/TLS tab:

• It's possible to enroll new devices. 
• From within the server web console I am able to sync the devices...
• ...but when a customer try to sync his device within the "Sophos Control" app, he gets the "Error 2033"

Regards

Chris

In reply to Shweta:

The new cert is active within the web console - new enrollments are not tested due to the resaon of short downtime.

I went back to old snapshot

In reply to TillLober:

Hi TillLober and Christoph Bucher 

I discussed the reported issue with the team, this issue is being currently investigated by our development team where an error occurs while SSL certificate hash renewal for existing devices. It is likely to be fixed in the upcoming version release, we will be notifying the same once the version with the fix is released. 

In reply to Shweta:

Hi,

what workaround is possible? what timeframe is planned for this hotfix?

In reply to TillLober:

Hi TillLober 

According to current planning, this should be available in the course of the next week. However, I do not have any specific date for the version release. Once it is released we will be updating our forums. For testing purposes, Would it be possible to send a message to the affected device? The communication should work again after receiving the message. 

In reply to Shweta:

Hi Shweta, Hi Till

I tested the "trick" with sending a message to an affected device. Unfortunately this didn't work. On the device, there pops up, that it received a message, but when the customer try to read this message, he gets again the "Error 2033".

Kind regards!

Chris

In reply to Christoph Bucher:

Hi Chris,

thank you for the test - I can not test this because we are running on production and outages are monitored and charged to my account... I invested 2 tries to change the cert (see initial post and had no success - I support SMC starting Version 2.0 and have years of experience within mobile device management (not a newbe, started 1998 with Nokia Communicator my first mobile business)

In reply to TillLober:

Good Morning everybody!

Any news about a solution? We still struggle with this problem and we wouldn't be pleased 'bout re-enroll all devices :P

Today, I gonna do some testing again:

. Switch back to the old certificate on to SM Server as well as on the Apache2 reverse proxy.

. Enroll a device.

. Upgrade to the new certificate on SM Server and Apache2 reverse proxy according to community.sophos.com/.../123984.

. Check state of previously enrolled device

Regards!

Chris

In reply to Christoph Bucher:

Hi Sophos,

please give us information regarding this bug - where is the old cert cached?

1. in the Database?

2. within the App-Server?

3. other location

I have only two weeks remaining to change the cert due to christmas holidays and we do not want to get into struggle during this time.

We need a solution/more information. In former times there were also problems with certs and Sophos published no patch - only a „dirty hack“

Sophos: please give us information to solve this.

In reply to TillLober:

Hi TillLober 

I did discuss about the version release with our team, our team has been coordinating with Apple support and we are expecting the release this week. Apologies for the inconvenience.