Troubleshoot Connection to URL Retrospective Registration Service Failed. Certificate Verification Failed.

Introduction

This document describes information and troubleshooting steps to help identify and correct communication issues between the Cisco Secure Email Gateway and the URL Retrospective Service.

Background

An internal service, known as the enrollment client, is responsible for keeping service certificates current. However, in certain network situations, this process can become unresponsive and cease retry attempts. This can result in the timely non-receipt of an updated certificate, leading to service disruption.

Note: Cisco TAC highly recommends that all customers running AsyncOS release 15.0 and higher proactively run the ecupdate command, as described in this article, to resolve and prevent this potential issue.

Components Used

This document is not restricted to specific software and hardware versions.

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Symptoms

The system generates these alerts:

20 May 2025 07:37:04 +0700 Connection to URL Retrospective registration service failed. Certificate verification failed. Contact Cisco TAC for assistance.

These alerts are sent to the configured email address. If an email address has not been associated with alerts, they can be checked by navigating to System Administration >> Alerts and clicking View Top Alerts, or by running the displayalerts CLI command. 

These errors can be found within the ecs logs:

esa01.example.com> grep "Warning|Critical" ecs

Fri May 16 18:57:05 2025 Warning: ECS: Cloud query failed. 'Empty polling URI.' 7-xyxxyzxyxxyz (or b'xyxxyzxyxxyzxyxxyzxyxx==' in base64 format) having URLs. Contact Cisco TAC for assistance.
Fri May 16 18:57:31 2025 Critical: ECS: Failed to regenerate token. Status Code: 403. Invalid Certificate.

Workaround

To resolve this issue, establish an SSH connectoion to your appliance and run ecupdate force:

esa01.example.com> ecupdate force

Requesting forced update of Enrollment Client.

To verify the successful update of the enrollment client, please monitor the updater_logs and ecs logs:

esa01.example.com> tail updater_logs

Tue May 20 11:26:19 2025 Info: Received remote command to signal a manual update
Tue May 20 11:26:51 2025 Info: Acquired server manifest, starting update 9030
Tue May 20 11:26:51 2025 Info: Server manifest specified an update for case
Tue May 20 11:26:52 2025 Info: Server manifest specified an update for enrollment_client
Tue May 20 11:26:52 2025 Info: enrollment_client was signalled to start a new update
Tue May 20 11:26:52 2025 Info: enrollment_client processing files from the server manifest
Tue May 20 11:26:52 2025 Info: enrollment_client started downloading files
Tue May 20 11:26:52 2025 Info: enrollment_client waiting on download lock
Tue May 20 11:26:52 2025 Info: enrollment_client acquired download lock
Tue May 20 11:26:52 2025 Info: enrollment_client beginning download of remote file "http://updates.ironport.com/enrollment_client/3.0/enrollment_client/default/109101"
Tue May 20 11:26:52 2025 Info: enrollment_client released download lock
Tue May 20 11:26:52 2025 Info: enrollment_client successfully downloaded file "enrollment_client/3.0/enrollment_client/default/109101"
Tue May 20 11:26:52 2025 Info: enrollment_client started applying files
Tue May 20 11:26:52 2025 Info: enrollment_client applying file "enrollment_client"
Tue May 20 11:26:52 2025 Info: enrollment_client installing new libexec
Tue May 20 11:26:52 2025 Info: enrollment_client restarting
Tue May 20 11:26:55 2025 Info: enrollment_client verifying applied files
Tue May 20 11:26:55 2025 Info: enrollment_client updating the client manifest
Tue May 20 11:26:55 2025 Info: enrollment_client update completed
Tue May 20 11:26:55 2025 Info: enrollment_client waiting for new updates

esa01.example.com> tail ecs

Tue May 20 09:05:21 2025 Info: ECS: Device registration successful.