This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

9.5.2: Change of certificate does not work (bug?)

TillLober over 5 years ago

Hi,

i tried to change a cert within 9.5.2 -

Proceeded this: https://community.sophos.com/kb/en-us/122559

1. Wizard, Import, Webconsole, detect certs, deleted old ones.

2. Restarted server, I get Error 2033 within SMC Control Agent (iOS)

3. Restarted Mobile Terminal, no change

4. like 1. I renerated self signed cert - and afters this I i imported (goto Number 1) - and after this replace with official cert.

All did not help - i reverted my snapsot an I hope you'll have a solution for me. I have 2 weeks to go with the old cert - perhaps someone other has tried to renew/replace the SSL Server cert with SMC 9.5.2 running on Windows Datacenter 2016.

Webbrowser opens console without error.

This thread was automatically locked due to age.

0 Jasmin over 5 years ago

Hi TillLober

Would you please confirm that the new/old SSL certificate follows the requirement mentioned in this article which requirement from Apple for iOS 13 and macOS Catalina?

Please refer to this article from Sophos on these requirements and follow steps.

Regards,

Jasmin
Community Support Engineer | Sophos Support
Sophos Support Videos | Knowledge Base | @SophosSupport | Sign up for SMS Alerts |
If a post solves your question use the 'This helped me' link
Cancel
Vote Up 0 Vote Down

Cancel
0 Christoph Bucher over 5 years ago in reply to Jasmin

Hi there!

I can confirm the same problem here. We updated to Version 9.5 and renewed our SSL/TLS certs. After this, my client devices get the 2033 sync error...

Regards

Chris
Cancel
Vote Up 0 Vote Down

Cancel
0 TillLober over 5 years ago in reply to Christoph Bucher

I purchased like always and never had problems. I checked my cert and there is nothing what is not supported - I think the cert cache within the App-Server has problem.

I‘m looking forward for a fix.

Thank you!
Cancel
Vote Up 0 Vote Down

Cancel
0 Shweta over 5 years ago in reply to TillLober

Hi TillLober

I am assuming that you have followed this article, could you please let me know which certificates are displayed in the certificate list of TLS/SSL tab of Mobile control server? Are you able to enroll any new device after renewing the certificate? Can you try to synchronize the devices on the server, and check the task status? I will be discussing this with our support team, and let you know if we can get more information related to this issue.

Shweta

Community Support Engineer | Sophos Technical Support
Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Cancel
0 Christoph Bucher over 5 years ago
Hi Folks

Our SSL certificate is presented like this in the SSL/TLS tab:

It's possible to enroll new devices.

From within the server web console I am able to sync the devices...

...but when a customer try to sync his device within the "Sophos Control" app, he gets the "Error 2033"

Regards

Chris
Cancel
Vote Up 0 Vote Down

Cancel
0 TillLober over 5 years ago in reply to Shweta

The new cert is active within the web console - new enrollments are not tested due to the resaon of short downtime.

I went back to old snapshot
Cancel
Vote Up 0 Vote Down

Cancel
0 Shweta over 5 years ago in reply to TillLober

Hi TillLober and Christoph Bucher

I discussed the reported issue with the team, this issue is being currently investigated by our development team where an error occurs while SSL certificate hash renewal for existing devices. It is likely to be fixed in the upcoming version release, we will be notifying the same once the version with the fix is released.

Shweta

Community Support Engineer | Sophos Technical Support
Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Cancel
0 TillLober over 5 years ago in reply to Shweta

Hi,

what workaround is possible? what timeframe is planned for this hotfix?
Cancel
Vote Up 0 Vote Down

Cancel
0 Shweta over 4 years ago in reply to TillLober

Hi TillLober

According to current planning, this should be available in the course of the next week. However, I do not have any specific date for the version release. Once it is released we will be updating our forums. For testing purposes, Would it be possible to send a message to the affected device? The communication should work again after receiving the message.

Shweta

Community Support Engineer | Sophos Technical Support
Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Cancel
0 Christoph Bucher over 4 years ago in reply to Shweta

Hi Shweta, Hi Till

I tested the "trick" with sending a message to an affected device. Unfortunately this didn't work. On the device, there pops up, that it received a message, but when the customer try to read this message, he gets again the "Error 2033".

Kind regards!

Chris
Cancel
Vote Up 0 Vote Down

Cancel