Could not validate certificate! CAA Will now close

Hello Fotit,

Thank you for reaching out to the community, XG is sending the CA certificate with the future date stored under “/conf/certificate/internalcas/ClientAuthentication_CA.der”

Did you recently upgrade the firmware ? 
If that is the case, then 

1) Need to rollback to previous version where CAA agent is working fine.

2) Make sure that time is correctly set on the appliance in that firmware version.

3) Upgrade the firmware.

Hi Vivek

but it was working very for two months...!!

I did upgrade at the beginning of July.. (sfos 18.5.3 MR3 Build 408   -----> sfos 18.5.4 MR4 Build 418)

i have HA

You say on 1) rollback and on 3) Upgrade the firmware !?

Check for both the appliances under the advance shell:
#ls -lah /conf/certificate/internalcas/*
see the dates !!

But i think it's install date ,no?

Can you rollback and check before the upgrade and after upgrade results ?

Can you rollback and check before the upgrade and after upgrade results ?

Thanks Vivek for your replys

I think  it's a bit complicated in PRODUCTION, just for testing
Break HA
downgrade fw1
test result
upgrade
Build HA...

Hello Fotit,

HA is Active-Active or Active-Passive? HA means 0 downtime, it would be great if you raise the case with Sophos Support to help you upgrading the firmware version 

Refer below link for the same : 

https://docs.sophos.com/nsg/sophos-firewall/18.5/Help/en-us/webhelp/onlinehelp/HighAvailablityStartupGuide/HAFirmwareUpgrade/index.html 

Follow the below link for Sophos Firewall: Suggestions before updating the SFOS firmware version

https://support.sophos.com/support/s/article/KB-000039405?language=en_US 

Regards

Hello Bharat & Vivek

After some thought, I contacted support, they didn't find a problem!
So I decided to do a reboot, just to see what it will give.
finally the CAA worked after the reboot.
Why? I don't know.

thanks for your help.

That's very weird, cheers it worked for you !! 

thank you very much for your help

I would suggest to plan upgrade the firmware to the latest version and share the feedback 

Go through the Sophos release notes below link to plan upgrade.

https://docs.sophos.com/releasenotes/index.html?productGroupID=nsg&productID=xg&versionID=19.0 

The latest firmware is available to refer the following link: https://community.sophos.com/sophos-xg-firewall/b/blog/posts/sophos-firewall-v19-mr1-re_2d00_release-build-365-is-now-available 

Thanks and Regards

Bharat,

I think waiting until it appears in my console over the next few weeks.

I read the thread above , and there are some issues with ipsec site-to-site after upgrading

I have 15 branchs with vpn ipsec site-to-site, so I remain cautious for the moment and I will follow the evolution of things.

Hey Fotit,

Have you gone through the release notes: 

Sure thing

Okay, Vivek Bharat , i have noted :)