Field Notice: FN74214 - Cisco Secure Firewall Management Center: Root Certificate Authority Expiration May Cause Cisco Firepower Threat Defense Devices To Become Unmanaged - Software Upgrade Recommended

The Cisco Secure Firewall Management Center (FMC) internal self-signed root Certificate Authority (CA) is valid for 10 years. After the root CA expires, Cisco Secure Firewall Threat Defense (FTD) devices may transition to an unmanaged and degraded state. Depending on the date of the Cisco Secure FMC build, there may be upcoming certificate expiry that requires renewal.

The validity period for the Cisco Secure FMC self-signed root CA begins on the build date of the initially installed software release and lasts for 3650 days (10 years). This CA is used to generate and sign certificates that establish a secure management tunnel (sftunnel) connection to managed Cisco Secure FTD devices. To avoid losing the ability to manage these devices and to prevent a more complex renewal process, a new root CA must be generated and distributed to the managed Cisco Secure FTD devices before the current one expires.

To check the expiration date of the root CA, use the following commands:

> expert

$ sudo /usr/bin/openssl x509 -noout -startdate -enddate -in /etc/sf/ca_root/cacert.pem

       notBefore=Apr 15 08:55:23 2014 GMT

       notAfter=Apr 13 08:55:23 2024 GMT ---> This is the root CA expiration date. 

The issue will exhibit the following three symptoms:

Symptom 1: The Devices tab in the Cisco Secure FMC console will show that the Cisco Secure FTD device is disconnected, indicated by a "Ø" symbol.

Symptom 2: Once the root CA expires, any disruption in the connection between Cisco Secure FMC and Cisco Secure FTD, including network issues or reboots of either device, will prevent the reconnection and result in a loss of all management capabilities. Some important functions that will stop working include, but are not limited to, the following:

• Changing the configuration of currently managed Cisco Secure FTD devices.
• Collecting backup files from managed Cisco Secure FTD devices.
• Registering new Cisco Secure FTD devices with Cisco Secure FMC.
• Analyzing traffic using Cisco Secure FMC.
• Deploying the latest Vulnerability Database (VDB) and Secure Rule Update (SRU). This may result in a degraded security posture for future threats.

Important: While management capabilities are lost, Cisco Secure FTD devices should continue to operate with their existing configurations.

Symptom 3: An error log similar to the following example will be present on Cisco Secure FTD devices in the /ngfw/var/log/messages file.

> expert

$ sudo cat /ngfw/var/log/messages | grep sftunnel
Sep 20 04:10:47 FTD SF-IMS[50792]: [51982] sftunneld:sf_ssl [INFO] Initiating IPv4 connection to 10.0.0.3:8305/tcp
Sep 20 04:10:47 FTD SF-IMS[50792]: [51982] sftunneld:sf_ssl [INFO] Wait to connect to 8305 (IPv4): 10.0.0.3
Sep 20 04:10:47 FTD SF-IMS[50792]: [51982] sftunneld:sf_ssl [INFO] Connected to 10.0.0.3 from resolved_ip_list (port 8305) (IPv4)
Sep 20 04:10:47 FTD SF-IMS[50792]: [51982] sftunneld:sf_ssl [ERROR] -Error with certificate at depth: 1
Sep 20 04:10:47 FTD SF-IMS[50792]: [51982] sftunneld:sf_ssl [ERROR] issuer = /title=InternalCA/OU=Intrusion Management System/CN=06f5f3ca-c77b-11e2-81bf-884d9d11f3ef/O=Sourcefire, Inc.
Sep 20 04:10:47 FTD SF-IMS[50792]: [51982] sftunneld:sf_ssl [ERROR] subject = /title=InternalCA/OU=Intrusion Management System/CN=06f5f3ca-c77b-11e2-81bf-884d9d11f3ef/O=Sourcefire, Inc.
Sep 20 04:10:47 FTD SF-IMS[50792]: [51982] sftunneld:sf_ssl [ERROR] err 10:certificate has expired
Sep 20 04:10:47 FTD SF-IMS[50792]: [51982] sftunneld:sf_ssl [ERROR] SSL_renegotiate error: 1: error:00000001:lib(0):func(0):reason(1)
Sep 20 04:10:47 FTD SF-IMS[50792]: [51982] sftunneld:sf_ssl [ERROR] Connect:SSL handshake failed
Sep 20 04:10:47 FTD SF-IMS[50792]: [51982] sftunneld:sf_ssl [WARN] SSL Verification status: certificate has expired

This issue can be resolved without contacting Cisco TAC for these two scenarios:

• The root CA is expired or will expire soon, but Cisco Secure FMC still has access to Cisco Secure FTD devices. Proceed to the Solution.
• For Cisco Secure FMC High-Availability (HA) pair configurations, the root CA on the primary Cisco Secure FMC has expired and the root CA on the secondary Cisco Secure FMC has not expired. Switch to the secondary Cisco Secure FMC to maintain Cisco Secure FTD device management and proceed to the Solution to fix the primary Cisco Secure FMC.

Important: Do not change the Cisco Secure FTD device manager configuration if Cisco Secure FMC management access is lost.

Solution

Step 1: Apply the recommended hotfix or Firepower software upgrade to the Cisco Secure FMC as shown in the following table. After the hotfix or Firepower software upgrade is applied, proceed to Steps 2 and 3 to resolve the root CA issue.

The hotfix links and supporting information are available in the Cisco Secure Firewall Threat Defense/Firepower Hotfix Release Notes.

Step 2: Enter expert mode in Cisco Secure FMC and run the generate_certs.pl script to renew the root CA, as shown in the following example:

> expert

$ sudo generate_certs.pl

       setting log file to /var/log/sf/sfca_generation.log
       You are about to generate new certificates for FMC and devices.
       After successful cert generation, device specific certs will be pushed automatically.
       If the connection between FMC and a device is down,
       user needs to copy the certificates onto the device manually.
       For more details on disconnected devices, use sftunnel_status.pl
       Do you want to continue? [yes/no]:yes 

Step 3: Enter expert mode in Cisco Secure FMC and enter the command shown in the following example to verify the new root CA expiration date:

> expert

$ sudo /usr/bin/openssl x509 -dates -noout -in /etc/sf/ca_root/cacert.pem

       notBefore=Apr 15 08:55:23 2024 GMT

       notAfter=Apr 13 08:55:23 2034 GMT ---> This is the renewed root CA expiration date.

The following scenarios may require contacting Cisco TAC. Before doing so, read Renewal of FMC Sftunnel CA Certificate for FTD Connectivity for additional information.

• The root CA is expired and Cisco Secure FMC management of Cisco Secure FTD devices is already lost.
• The root CA on the primary and secondary Cisco Secure FMCs have expired (for Cisco Secure FMC High-Availability (HA) pair configurations).
• Following the preceding steps in the Solution section does not fix the issue.

Cisco offers a guided upgrade experience through the Cisco Secure Firewall Upgrade program. This program will provide environment-specific software upgrade guidance, a customized procedure to follow, and a customized pre-upgrade checklist. For additional information and to register for the upgrade program, see Get access to Cisco Secure Firewall LevelUp.