topic Re: How to renew CMA ICA in Firewall & Security Management

How to renew CMA ICA

Kaspars_Zibarts — Wed, 20 Jun 2018 09:02:40 GMT

Ok, this should have been rather easy and obvious. Internal CA for CMA has expired and I want to renew it. Gateways - easy peasy. But with management / CMA i struggle to find a single reference in User Centre / SKs. Anyone?

Re: How to renew CMA ICA

ED — Wed, 20 Jun 2018 10:55:52 GMT

Hope this helps Invoking the ICA Management Tool

Connect to Internal CA Management Tool with a web browser.

Also this Expired certificates cannot be deleted from the Management Database

Re: How to renew CMA ICA

Kaspars_Zibarts — Wed, 20 Jun 2018 11:14:08 GMT

I did just that before but there are no tools to "renew" certs per say. Does that mean that deleting Expired certs will automatically recreate valid one?

Re: How to renew CMA ICA

Kaspars_Zibarts — Wed, 20 Jun 2018 11:28:13 GMT

False alarm, looked at the wrong cert! It was not CMA ICA cert! Sorry

Re: How to renew CMA ICA

ED — Wed, 20 Jun 2018 11:39:17 GMT

Bad suggestion.

"Use the ICA management tool for user certificate operations only, such as certificate creation. Do not use the ICA management tool to change SIC certificates or VPN certificates. Change SIC and VPN certificates in SmartConsole."

Re: How to renew CMA ICA

Houssameddine_1 — Wed, 20 Jun 2018 16:59:04 GMT

you can use the command cp_conf ca, becarfull in production, you have to restablish sic to every firewall managed by this CMA.

cp_conf ca :Description Initialize the Certificate Authority Syntax

> cp_conf ca init

> cp_conf ca fqdn Parameter Description init Initializes the internal CA fqdn Sets the FQDN of the internal CA to >cp_conf finger Description Displays the fingerprint which will be used on first-time launch to verify the identity of the Security Management server being accessed by the SmartConsole. This fingerprint is a text string derived from the Security Management server's certificate Syntax

> cp_conf finger get

Thanks