Sophos Heartbeat not working / Errors in heartbeatd.log

Question

Some of our endpoints are blocked because of missing heartbeat. 
 The heartbeat.log from the endpoint: 
 2022-05-30T12:56:17.558Z [ 3812: 4508] A ----------------------------------------------------------------------------------------------------
2022-05-30T12:56:17.569Z [ 3812: 4508] A Starting Heartbeat version 1.15.835.0
2022-05-30T12:56:17.573Z [ 3812: 4508] A ----------------------------------------------------------------------------------------------------
2022-05-30T12:56:17.809Z [ 3812: 5316] E TLS authentication failed after connecting.
2022-05-30T13:03:14.003Z [ 3812: 4508] A ----------------------------------------------------------------------------------------------------
2022-05-30T13:03:14.006Z [ 3812: 4508] A Stopped Heartbeat
2022-05-30T13:03:14.014Z [ 3812: 4508] A ---------------------------------------------------------------------------------------------------- 
 The heartbeatd.log from our Sophos XG450 (SFOS 18.5.3 MR-3-Build408) is full of these messages: 
 [2022-05-30 17:13:26.479Z] INFO HBSessionHandler.cpp[24885]:125 removeDirtySessions - Number of sessions: 50
[2022-05-30 17:13:26.508Z] WARN HBSession.cpp[24885]:344 bufferDisconnectEvent - Incoming connection from 172.16.202.64 failed. SSL error: SSL routines:ssl3_get_client_certificate certificate verify failed 
 Does anyone have an idea?

Markus Ottmann1 · Accepted Answer

It is solved! This morning the update to v19 was successful and the heartbeat problem is gone.

LHerzog · Answer

we've had this when going to MR2 and it was the worst upgrade experience. 
 as a workaround: re-install intercept X on one of the devices. it pulls the correct certificates during installation, while running machines take hours or days. 
 but since middle of April is really a long time. 
 since our upgrade, when the heartbeat certificate of the firewall has been renewed, we notice the following when a known, working client connects: 
 1st attempt fails with the same error message you posted (this is the connection to the old previously used firewall certificate) 
 2nd attempt succeeds when connecting to the new firewall heartbeat certificate. 
 so still our firewall HB log is full with SSL errors even today. 
 
 there is some debugging and descriptions in the unorganized responses to this thread: https://community.sophos.com/sophos-xg-firewall/f/discussions/131468/sophos-firewall-v18-5-mr2-feedback-and-experiences

failed: old cert used by client 
 succeeded: new cert used by client 
 
 Sophos argued, this was caused by FW rules with HB requirement, but this was not true - this applies only for firewall rules towards Sophos Central and DNS and there has not been a HB requirement. In the end, they could not identify the root cause after 2 months of debugging. 
 
 Check the certificates used by the firewall: 
 /conf/sysfiles/heartbeatd/ 
 server.crt server.key 
 with those used by the client 
 C:\ProgramData\Sophos\Heartbeat\Config\Heartbeat.xml 
 you would need to export the individual certificates to crt files or certificate analysis tools and can then identify them. 
 
 Debug tips: 
 
 Relevant entries from the HBTrust Log file 
 Relevant entries from heartbeat.log in debug mode (service -t json -b '{"debug":"1"}' -ds nosync heartbeat:debug) 
 Tcpdump from the UTM for the host 52.5.76.173 on port 8347

Our case No. from January 2022, if case you need it for case-cross-reference. 
 04793577 / Heartbeat Connection SSL error after update

Sophos Heartbeat not working / Errors in heartbeatd.log

Top Replies

Submitted a Tech Support Case lately from the Support Portal?