This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

unable to open support ticket - certificate expired

Hello,

I noticed the certificate for CA Globalsign used by the ASG has expired.
I would like to open a support ticket but sadly enough myastaro.com seems to be using a Globalsign certificate. Here is the web proxy error page:

Untrusted Website

While trying to retrieve the URL: https://my.astaro.com/supportCases.php (Add exception for this URL)
Status certificate has expired
Subject /2.5.4.15=Private Organization/serialNumber=02096520/1.3.6.1.4.1.311.60.2.1.3=GB/C=GB/ST=Oxfordshire/L=Abingdon/streetAddress=The Pentagon/O=Sophos Ltd./CN=www.sophos.com
Issuer /C=BE/O=GlobalSign nv-sa/CN=GlobalSign Extended Validation CA - G2
SHA1 Fingerprint 3D:8B[:D]3:64:BA:65:7E:2D:59:82:2E:06:60:A5:44:A4:68:6A:38:89
MD5 Fingerprint 69:78:C4:9D:9F:21:8B:70:0B:51:50:4C:44:EC:AF:1B
Valid from Aug 29 10:37:05 2013 GMT
Valid until Aug 1 13:45:02 2014 GMT

As you can see the actual certificate is valid, not that the ASG uses internally.
I experience the same behaviour for multiple Globalsign certified https sites.
I have no problem accessing those sites directly, browsers show the correct certificates.

I am using ASG Firmware version: 8.311
Pattern version: 56544

Thank you for your help.

This thread was automatically locked due to age.

0 Stelektro over 11 years ago
v9 is not an option, if it does'nt match your organization or sizing. Btw v8 is still supported.
e.g. in our environment, a migration to v9 would result in a 15-24k€ invest!

News from support: unfortunately none!
We've imported several root and intermediate CAs from globalsign but ASG v8 will not trust a website, that has a https certificate issued by globalsign.

Why do they not simply make a small patch that removes the old globalsign CA form their CA list and replace it with the new one, expiring in 2028?
My opinion is that the main problem is, that the old CA is still present in ASG and that it overrides a manually added CA with the same name.

OK, when I read my last comment again, I got the idea to disable the old globalsign root CA in ASG. Now it finally seems to work.
Doings:
Disabled
GlobalSign nv-sa GlobalSign Root CA
with Fingerprint: 2F:17:3F:7D:E9:96:67:AF:A5:7A:F8:0A:A2[[[[:D]]]]1:B1:2F:AC:83:03:38

Manually added
GlobalSign nv-sa GlobalSign Root CA
Fingerprint: 1:BC:96:8B[[[[:D]]]]4:F4:9D:62:2A:A8:9A:81:F2:15:01:52:A4:1D:82:9C
GlobalSign nv-sa GlobalSign Organization Validation CA - G2
Fingerprint: 9:EE:85:A1:0F[[[[:D]]]]4:95[[[[:D]]]]9:94:ED:63:48:8A:B7:4A:18:CB:8E:6B:FA
Cancel
Vote Up 0 Vote Down

Cancel
0 Toothpick over 11 years ago

Thank you Stelektro.
Your opinion is further validated by this announcement from Globalsign about the expired certificate: https://support.globalsign.com/customer/portal/articles/1426272-expiration-of-old-globalsign-2014-root-ca-certificate

Following your posts I was able to use locally uploaded Globalsign certificates once I disabled the built-in ones.

This is a temporary solution but lift the hassle of user required exceptions off my back.
Support asked for remote control of my UTM which I cannot allow. I supplied them with this thread.
Cancel
Vote Up 0 Vote Down

Cancel