topic Re: SNX stops working after we upload new certificate in General Topics

SNX stops working after we upload new certificate

Blason_R — Tue, 31 Oct 2023 03:43:25 GMT

Hi Team,

This happens usually and I am not sure what I am doing wrong. Whenever our Mobile access SSL portal certificate expires we upload it in a pfx or p12 format. This pfx we create on a Linux machine using openssl command.

I tried creating a pfx file with numerous ways i.e. appending intermediate and root certificate in a signed certificate file then using openssl command.

openssl pkcs12 -export -out exmpale.pfx -inkey example.key -in exmaple.crt

However when we upload the pfx or p12 certificate the snx most of the time hangs on a connecting prompt. last time I faced the same issue and then I created a pfx file using below command and it worked.

openssl pkcs12 -export -out azvpn.pfx -inkey azvpn.key -in azvpn.crt -certfile gd_bundle-g2-g1.crt

So I did not find a single solution that worked; every time it was just a fluke by creating pfx file and it worked.

Re: SNX stops working after we upload new certificate

G_W_Albrecht — Tue, 31 Oct 2023 08:30:20 GMT

Does not look like you followed sk69660 !

Re: SNX stops working after we upload new certificate

Alex- — Tue, 31 Oct 2023 08:59:55 GMT

Give a look at sk176932 - SNX fails after replacing the Mobile Access certificate.

Re: SNX stops working after we upload new certificate

G_W_Albrecht — Tue, 31 Oct 2023 09:37:12 GMT

Not the same issue - here, snx most of the time hangs on a connecting prompt. In sk176932 you get an error on connecting...

Re: SNX stops working after we upload new certificate

Blason_R — Tue, 31 Oct 2023 10:10:10 GMT

I really doubt that would make any difference. I used openssl on another Linux box and then I created p12 using openssl. Will that cause any difference? I guess cpopenssl is nothing but a compiled version of openssl

Re: SNX stops working after we upload new certificate

G_W_Albrecht — Tue, 31 Oct 2023 10:21:39 GMT

Will not make a difference if you did follow the steps from sk69660. Better contact TAC so they can analyse this behaviour !