Troubleshoot Threat Defense certificates

See Secure Firewall Threat Defense VPN certificate guidelines and limitations to determine if variations in your certificate enrollment environment may be causing a problem.

Certificate expiration monitoring

CA server connectivity

Ensure there is a route to the CA Server from the device. If the CA Server's host name is given in the Enrollment Object, use Flex Config to configure DNS appropriately to reach the server. Alternatively, use the IP Address of the CA Server.

Microsoft 2012 CA server template configuration

If you are using a Microsoft 2012 CA Server, the default IPsec Template is not accepted by the managed device and must be changed.

To configure a working template, follow these steps as you use MS CA documentation as a reference.

  1. Duplicate the IPsec (Offline Request) template.

  2. In Extensions > Application policies, select IP security end system, instead of the IP security IKE intermediate.

  3. Set the permissions and the template name.

  4. Add the new template and change the registry settings to reflect the new template name.

Default keyring certificate regeneration

On the Cloud-Delivered Firewall Management Center, you might receive this health alert related to the Firewall Threat Defense device:

Code - F0853; Description - default Keyring's certificate is invalid, reason: expired

Solution: In such cases, use the following command to regenerate the default certificate in CLISH CLI:

> system support regenerate-security-keyring default

CA certificate configuration errors

A red cross appears in the CA certificate status with this error:

Error: Fail to configure CA certificate

Solution: See Troubleshoot Certificate Error on FMC.

Certificate verification in .pfx files

To check the list of the certificates in a .pfx file, use tools such as certutil or openssl. You can see the whole chain with ID certificate, SubCA certificate, and CA certificate (if any).

  • certutil -dump cert.pfx

  • openssl pkcs12 -info -in cert.pfx

Identity certificate import errors

Error: Identity certificate import required

Solution: See Troubleshoot Certificate Error "Identity certificate import required" on FMC.

Self-signed certificates hostname behavior in Threat Defense high-availability environments

In a Threat Defense HA configuration, the secondary unit adopts the primary unit's hostname. When you break the HA pair, you must perform these actions:

  • Manually update the hostname on the secondary unit to its unique identifier

  • Perform a certificate re-enrollment to ensure that the certificate accurately reflects the unit's identity.