Secondary root certificate for TLS might need to be updated

Technical Articles ID: KB92937
Last Modified: 11/24/2020

Environment

All Microsoft Windows operating systems

All Linux operating systems

All macOS operating systems

Summary

The McAfee product line uses TLS for secure communication. Two certificates validate McAfee TLS chains, including a primary expiring in 2038 and a secondary that expired at 10:48 GMT, May 30, 2020. If either certificate, or both, are present in your environment, TLS functions correctly before May 30, 2020. After May 30, 2020, only the primary certificate is valid. Out of an abundance of caution, McAfee is informing customers of this event.

Generally, certificates are auto-updated through operating systems and customers are not impacted. But, customers might see an impact in environments with the following:

Automatic management of root certificates is disabled.
The primary certificate has not been manually deployed.

The primary certificate that needs to be validated in a customer's environment is below:

Subject	CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, S=New Jersey, C=US
Thumbprint	2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E
Expiration	2038-01-18 5:59:59 PM

The secondary certificate that has expired is below:

Subject	CN = AddTrust External CA Root OU = AddTrust External TTP Network O = AddTrust AB C = SE
Thumbprint	02faf3e291435468607857694df5e45b68851868
Expiration	Saturday, ‎May ‎30, ‎2020 4:18:38 PM

The certificate replacing the secondary certificate is below:

Subject	CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, S=Greater Manchester, C=GB
Thumbprint	D1EB23A46D17D68FD92564C2F1F1601764D8E349
Expiration	Sunday, ‎December 3‎1, ‎2028 23:59:59 PM

FAQs

What is the immediate action that I need to take?
You need to make sure that you have the primary certificate installed in your environment for all Windows systems.

How do I figure out if a system has an updated root certificate, and can I update it remotely?
To determine whether the system has the updated root certificate, see: KB92948 - How to check if a system has an updated root certificate and apply the certificate from Group Policy. The article also describes how you can apply the fix using Group Policy.

Are Linux environments impacted?
The certificate expiration does not impact Linux environments that use Endpoint Security for Linux Threat Prevention or VirusScan Enterprise for Linux.

Are macOS environments impacted?
For Endpoint Security for Mac environments, see KB92950 - Endpoint Security for Mac Global Threat Intelligence queries fail after a root certificate expired on May 30, 2020.

Why is the certificate not updated automatically?
By default, the Windows update automatically updates the trusted root certificates. Administrators can choose to disable this feature in favor of managing their environments' certificates manually. Also, some environments might have limited or no internet connectivity for Windows update to use to automatically update the certificate stores.

Does the update of the certificate require a reboot?
No. A reboot is not needed after you update the certificate.

Does this affect manageability from ePolicy Orchestrator?
ePolicy Orchestrator (ePO) manageability is not affected. For the possible issue with ePO, see KB92954 - Some ePO features or integrations might start to fail after May 29, 2020.

Solution 1

Option 1 - Windows: Install the certificate using Active Directory Group Policy

To determine whether the system has the updated root certificate, see: KB92948 - How to check if a system has an updated root certificate and apply the certificate from Group Policy. McAfee recommends that you install certificates using Active Directory Group Policy for wide deployment.

To update the certificate attached to this article on the systems using Active Directory Group Policy, follow the instructions in: KB92948 - How to check if a system has an updated root certificate and apply the certificate from Group Policy. The certificate is attached to this article as USERTrustRSACertificationAuthority.crt.

Option 2 - Windows: Install the certificate directly on the system
If you have a single system or only a few systems, you can use either of the following files to install the certificate directly on the system. Or, you can install the certificates remotely using any appropriate administrative deployment method.

To install the certificates, do one of the following:

Download the file USERTrust_2038.bat.txt in the Attachment section of this article. Rename the file to USERTrust_2038.bat and run it.
Download the file USERTrust_2038.reg.txt in the Attachment section of this article. Rename the file to USERTrust_2038.reg and import it.

Option 3 - Windows: Install the certificate on the system using ePO
McAfee recommends that you install certificates using Active Directory Group Policy for wide deployment. If this method is not an option in your environment, you can also choose to use an ePO deployable package to install the certificate. To install the certificate using this method, follow the below steps:

Download the EEDK package EEDK_PKG1001.zip from the Attachment section of this article.
Log on to your ePO server and check in the EEDK_PKG1001.zip package into your Master Repository.
Create a McAfee Agent Product Deployment Task and select this package for deployment.
Assign the client task to any systems for which you would like to deploy the root certificate.

Solution 2

Linux: Check whether the certificate is present and add it if needed

From a terminal session, execute the following commands to verify whether the UserTrust RSA Certificate with the new expiration date is present:

cd /etc/ssl/certs
openssl crl2pkcs7 -nocrl -certfile ca-bundle.trust.crt | openssl pkcs7 -print_certs -text -noout | less

To add the certificate, if needed, do the following:
1. Download the certificate USERTrustRSACertificationAuthority.crt from the Attachment section of this article.
2. Follow the instructions for your operating system type:
  - For Debian and Ubuntu type systems:
    1. Execute the following command:
      
      mkdir /usr/local/share/ca-certificates/
    2. Copy the downloaded USERTrustRSACertificationAuthority.crt file to the /usr/local/share/ca-certificates/ directory with the following command:
      
      sudo cp USERTrustRSACertificationAuthority.crt /usr/local/share/ca-certificates/USERTrustRSACertificationAuthority.crt
    3. Update the certificate store with the following command:
      
      sudo update-ca-certificates
  - For Red Hat, CentOS, and Fedora type systems:
    1. Copy the downloaded USERTrustRSACertificationAuthority.crt file to the /etc/pki/ca-trust/source/anchors directory with the following command:
      
      sudo cp USERTrustRSACertificationAuthority.crt /etc/pki/ca-trust/source/anchors/USERTrustRSACertificationAuthority.crt
    2. Update the certificate store with the following command:
      
      sudo update-ca-trust extract

Solution 3

macOS:
To remediate this issue for Endpoint Security for Mac, follow KB92950 - Endpoint Security for Mac Global Threat Intelligence queries fail after a root certificate expired on May 30, 2020.

Related Information

Attachment 1

USERTrust_2038.bat.txt
4K • < 1 minute @ broadband

Attachment 2

USERTrust_2038.reg.txt
6K • < 1 minute @ broadband

Attachment 3

USERTrustRSACertificationAuthority.crt
1K • < 1 minute @ broadband

Attachment 4

EEDK_PKG1001.zip
5K • < 1 minute @ broadband

Affected Products

Configuration
Endpoint Security for Mac Threat Prevention 10.x
ePolicy Orchestrator 5.9 (EOL)
ePolicy Orchestrator 5.10.x
Network Security Manager 9.2.x
Network Security Manager 9.1.x
Network Security Manager 10.x
Troubleshooting
Web Gateway 9.2.x
Web Gateway 9.1.x
Web Gateway 9.0.x
Web Gateway 8.2.x
Web Gateway 8.1.x (EOL)
Web Gateway 8.0.x (EOL)
Web Gateway 7.8

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Japanese
Portuguese Brasileiro
Chinese Simplified

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Knowledge Center

Secondary root certificate for TLS might need to be updated

Environment

Summary

Solution 1

Solution 2

Solution 3

Related Information

Attachment 1

Attachment 2

Attachment 3

Attachment 4

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Knowledge Center

Secondary root certificate for TLS might need to be updated

Environment

Summary

Solution 1

Solution 2

Solution 3

Related Information

Attachment 1

Attachment 2

Attachment 3

Attachment 4

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title