MDM and weak certificate

[Lockbits 10]

Hello guys,

We have a customer with the following issue. There're two Android devices that were updated to EESA version 2.9.4.0 and these two devices are reporting the following alert to ESMC:

I realized that version 2.9.4.0 has the following change:

Improved: Certificate security - insecure certificate warning during enrollment + certificate hostname verification (a warning displayed during update or enrollment)

How can we fix this certificate issue? The MDM was installed using the standard procedure. 

Thanks.

[Peter Randziak 1,130]

Hello,

the certificate requirements are listed at https://help.eset.com/esmc_install/72/en-US/certificate_mdm_https_requirements.html I would start with checking if it the one used meets those...

Peter

[Lockbits 10]

4 hours ago, Peter Randziak said:

Hello,

the certificate requirements are listed at https://help.eset.com/esmc_install/72/en-US/certificate_mdm_https_requirements.html I would start with checking if it the one used meets those...

Peter

Hi Peter,

In case we need to modify or change the certificate, it's necessary to enroll all devices again? Or the certificate can be changed without affecting connection to current smartphones?

[Peter Randziak 1,130]

Hello,

the certificate replacement process is described at https://help.eset.com/esmc_admin/72/en-US/certificate_replacement.html 

Peter

[Mirek S. 18]

Hello,

Android team is currently investigating this issue with self-signed certificates. If You use self-signed certificates (ESMC generated) please fill ticket with customer care so there is more data regarding this (we will need logs from phone and mdm certificate to speed up the process).

Sorry for inconvenience,

M.

Edited November 1, 2020 by Mirek S.

[Lockbits 10]

20 hours ago, Mirek S. said:

Hello,

Android team is currently investigating this issue with self-signed certificates. If You use self-signed certificates (ESMC generated) please fill ticket with customer care so there is more data regarding this (we will need logs from phone and mdm certificate to speed up the process).

Sorry for inconvenience,

M.

Hi Mirek,

I sent you a private message.

Thank you.

[Peter Randziak 1,130]

Hello guys,

We have probably identified the cause of the issue.

It seems that it happens after the device was unable to connect to MDM due to connectivity issues.

Fix should be included in upcoming versions.

Peter

(P_EES2A-3585)