A Root Certificate in a McAfee certificate chain might need to be updated

Technical Articles ID: KB92937
Last Modified: 6/12/2020

Environment

All Microsoft Windows operating systems
All Linux operating systems
All macOS operating systems

Summary

The McAfee product line uses TLS for secure communication. Two certificates validate McAfee TLS chains, including a primary expiring in 2038 and a secondary that expired at 10:48 GMT, May 30, 2020. If either certificate, or both, are present in your environment, TLS will function correctly before May 30, 2020. After May 30, 2020, only the primary certificate is valid. Out of an abundance of caution, McAfee is informing customers of this event.

Generally, certificates are auto-updated through operating systems and customers are not impacted. But, in environments where automatic management of root certificates is disabled and the primary certificate has not been manually deployed, customers can potentially be impacted.

The primary certificate that needs to be validated is in a customer's environment is below:

Subject	CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, S=New Jersey, C=US
Thumbprint	2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E
Expiration	2038-01-18 5:59:59 PM

The secondary certificate that has expired is below:

Subject	CN = AddTrust External CA Root OU = AddTrust External TTP Network O = AddTrust AB C = SE
Thumbprint	02faf3e291435468607857694df5e45b68851868
Expiration	Saturday, ‎May ‎30, ‎2020 4:18:38 PM

FAQs

What is the immediate action that I need to take?
You need to make sure that you have the primary certificate installed in your environment for all Windows systems.

How do I figure out if a system has an updated root certificate, and can I update it remotely?
To determine whether the system has the updated root certificate, see KB92948. The article also describes how you can apply the fix using Group Policy.

Are Linux environments impacted?
A Linux environment that uses Endpoint Security for Linux Threat Prevention or VirusScan Enterprise for Linux is not impacted by the certificate expiration.

Are MAC environments impacted?
For Endpoint Security for Mac environments, see KB92950.

Why is the certificate not updated automatically?
By default, the Windows update automatically updates the trusted root certificates. Administrators can choose to disable this feature in favor of managing their environments' certificates manually. Also, some environments might have limited or no internet connectivity for Windows update to use to automatically update the certificate stores.

Does the update of the certificate require a reboot?
No. A reboot is not needed after you update the certificate.

Does this affect manageability from ePolicy Orchestrator?
ePolicy Orchestrator (ePO) manageability is not affected. For the possible issue with ePO, see KB92954.

Solution

Option 1 - Windows: Install the certificate using Active Directory Group Policy

See KB92948 to determine whether the system has the updated root certificate.
McAfee recommends that you install certificates using Active Directory Group Policy for wide deployment. Follow KB92948 to update the certificate, attached to this article as USERTrustRSACertificationAuthority.crt, on the systems using Active Directory Group Policy.

Option 2 - Windows: Install the certificate directly on the system
If you have a single system or only a few systems, you can use either of the following files to install the certificate directly on the system. Or, you can install the certificates remotely using any appropriate administrative deployment method.

To install the certificates, do one of the following:

Download the file USERTrust_2038.bat.txt in the Attachment section of this article. Rename the file to USERTrust_2038.bat and run it.
Download the file USERTrust_2038.reg.txt in the Attachment section of this article. Rename the file to USERTrust_2038.reg and import it.

Option 3 - Windows: Install the certificate on the system using ePO
McAfee recommends that you install certificates using Active Directory Group Policy for wide deployment. If this method is not an option in your environment, you can also choose to use an ePO deployable package to install the certificate. To install the certificate using this method, follow the below steps:

Download the EEDK package EEDK_PKG1001.zip from the Attachment section of this article.
Log on to your ePO server and check in the EEDK_PKG1001.zip package into your Master Repository.
Create a McAfee Agent Product Deployment Task and select this package for deployment.
Assign the client task to any systems for which you would like to deploy the root certificate.

Solution

Linux: Check whether the certificate is present and add it if needed

From a terminal session, execute the following commands to verify whether the UserTrust RSA Certificate with the new expiration date is present:

cd /etc/ssl/certs
openssl crl2pkcs7 -nocrl -certfile ca-bundle.trust.crt | openssl pkcs7 -print_certs -text -noout | less

To add the certificate, if needed, do the following:
1. Download the certificate USERTrustRSACertificationAuthority.crt from the Attachment section of this article.
2. Follow the instructions for your operating system type:
  - For Debian and Ubuntu type systems:
    1. Execute the following command:
      
      mkdir /usr/local/share/ca-certificates/
    2. Copy the downloaded USERTrustRSACertificationAuthority.crt file to the /usr/local/share/ca-certificates/ directory with the following command:
      
      sudo cp USERTrustRSACertificationAuthority.crt /usr/local/share/ca-certificates/USERTrustRSACertificationAuthority.crt
    3. Update the certificate store with the following command:
      
      sudo update-ca-certificates
  - For Red Hat, CentOS, and Fedora type systems:
    1. Copy the downloaded USERTrustRSACertificationAuthority.crt file to the /etc/pki/ca-trust/source/anchors directory with the following command:
      
      sudo cp USERTrustRSACertificationAuthority.crt /etc/pki/ca-trust/source/anchors/USERTrustRSACertificationAuthority.crt
    2. Update the certificate store with the following command:
      
      sudo update-ca-trust extract

Solution

Mac:
To remediate this issue for Endpoint Security for Mac, follow KB92950.

Related Information

Attachment

USERTrust_2038.bat.txt
4K • < 1 minute @ broadband

Attachment

USERTrust_2038.reg.txt
6K • < 1 minute @ broadband

Attachment

USERTrustRSACertificationAuthority.crt
1K • < 1 minute @ broadband

Attachment

EEDK_PKG1001.zip
5K • < 1 minute @ broadband

Affected Products

Configuration
Endpoint Security for Mac Threat Prevention 10.x
ePolicy Orchestrator 5.9
ePolicy Orchestrator 5.10.x
Network Security Manager 9.2.x
Network Security Manager 9.1.x
Network Security Manager 10.x
Troubleshooting
Web Gateway 9.2.x
Web Gateway 9.1.x
Web Gateway 9.0.x
Web Gateway 8.2.x
Web Gateway 8.1.x
Web Gateway 8.0.x
Web Gateway 7.8

Languages:

This article is available in the following languages:

English United States
Japanese

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

A Root Certificate in a McAfee certificate chain might need to be updated

Environment

Summary

Solution

Solution

Solution

Related Information

Attachment

Attachment

Attachment

Attachment

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Featured Solutions

Explore Our Portfolio

Security Outcomes

Industries

Products

Featured Solutions

Explore Our Portfolio

MVISION Products

Services & Training

Threat Research

Our Researchers

Threat Landscape Dashboard

Tools

Contact Us

Resources

Downloads

Product Help

Connect with Us

Explore

Our Company

Our Efforts

Other Resources

Careers

Partnerships

A Root Certificate in a McAfee certificate chain might need to be updated

Environment

Summary

Solution

Solution

Solution

Related Information

Attachment

Attachment

Attachment

Attachment

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title