THIS FIELD NOTICE IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTY OF MERCHANTABILITY. YOUR USE OF THE INFORMATION ON THE FIELD NOTICE OR MATERIALS LINKED FROM THE FIELD NOTICE IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS FIELD NOTICE AT ANY TIME.
Revision | Publish Date | Comments |
---|---|---|
1.0 |
24-Mar-22 |
Initial Release |
Affected OS Type | Affected Software Product | Affected Release | Affected Release Number | Comments |
---|---|---|---|---|
NON-IOS |
Secure Network Analytics System Software |
7.1 |
7.1.1, 7.1.2, 7.1.3 |
|
NON-IOS |
Secure Network Analytics System Software |
7.2 |
7.2.1 |
|
NON-IOS |
Secure Network Analytics System Software |
7.3 |
7.3.0, 7.3.1 |
Defect ID | Headline |
---|---|
CSCwb25870 | QuoVadis certificate replacement impacts to Secure Network Analytics (Stealthwatch) |
For affected versions of the Secure Network Analytics software, some Secure Sockets Layer (SSL) certificates issued from the QuoVadis root certificate authority (CA) trust chain before March 31, 2021 cannot be renewed from this CA. Once those certificates expire on devices or are removed from the Cisco cloud servers, functions such as Smart Licensing, Global Threat Alerts, Cisco Threat Response, and SecureX integrations will fail to establish secure connections to Cisco and might not operate properly.
The QuoVadis Root CA 2 Public Key Infrastructure (PKI) used by Secure Network Analytics software to issue SSL certificates is subject to an industry-wide issue that affects revocation abilities. Due to this issue, no new QuoVadis Root CA 2 certificates will be issued or renewed by Cisco after March 31, 2021. This affects certificate renewals on devices, Cisco cloud servers, and third-party services.
Certificates issued before the QuoVadis Root CA 2 was decommissioned will continue to be valid. However, the certificates will not renew when they expire on either the device or the Cisco cloud server. This will cause functions such as Smart Licensing, Global Threat Alerts, Cisco Threat Response, and SecureX integrations to fail to establish secure connections to Cisco cloud servers.
This table shows a summary of the QuoVadis Root CA 2 certificate expiration dates for affected Cisco services.
Cisco Cloud Server | QuoVadis Certificate Expiration Date | Affected Services |
---|---|---|
tools.cisco.com | February 5, 2022 |
|
https://visibility.amp.cisco.com/ https://visibility.eu.amp.cisco.com/ https://visibility.apjc.amp.cisco.com/ |
November 3, 2022 |
|
https://securex.us.security.cisco.com/ https://securex.eu.security.cisco.com/ https://securex.apjc.security.cisco.com/ |
January 10, 2023 |
|
https://cta.eu.amp.cisco.com/ https://cognitive.cisco.com/ https://td.cloudsec.sco.cisco.com/CWSP/ https://cta.eu.amp.cisco.com/taxii https://taxii.cloudsec.sco.cisco.com/ |
January 14, 2023 |
|
Expiration of the QuoVadis Root CA 2 certificates affects these services with the associated symptoms.
Affected Services | Symptoms for Affected Services |
---|---|
Smart Licensing | Failure to connect to the server (Details are provided in this section) |
Smart Call Home | Failure to connect to the server and the Call-Home HTTP request fails Note: Smart Call Home is the carrier for Smart Licensing and other telemetry data communication. |
Cisco Threat Response Integration | Failure to connect to the servers |
SecureX Integration | Failure to connect to the servers |
Global Threat Alert Integration | Failure to connect to the servers |
Affected Secure Network Analytics devices will be unable to connect to the Smart Licensing, Global Threat Alerts, Cisco Threat Response, and SecureX integration services hosted by Cisco. Smart licenses might fail entitlement and reflect an Out of Compliance status.
The features that use Smart Licensing will continue to function for one year after the last successful secure connection. Some Smart Licensing symptoms are:
Offline licensing, such as Permanent License Reservation (PLR) and Specific License Reservation (SLR), is not affected by the certificate change on the Smart Licensing server.
For additional information, refer to the Cisco Smart Licensing Guide and the Secure Network Analytics Smart Software Licensing Guide for your specific version of Secure Network Analytics software.
For Secure Network Analytics devices, the Smart Software License Status screen will show a License Authorization Status of “Out of Compliance".
Cisco has migrated from the QuoVadis Root CA 2 to the IdenTrust Commercial Root CA 1 for SSL certificates.
Cisco recommends to upgrade to Secure Network Analytics software Version 7.3.2 or later.
Cisco has created a web page to provide customers and partners with additional information on this issue. Consult the QuoVadis Root CA 2 Decommission page for a full list of products affected, associated Field Notices, and frequently asked questions.
If you require further assistance, or if you have any further questions regarding this field notice, please contact the Cisco Systems Technical Assistance Center (TAC) by one of the following methods:
My Notifications—Set up a profile to receive email updates about reliability, safety, network security, and end-of-sale issues for the Cisco products you specify.