McAfee Agent Smart Installs fail for ePO Cloud after a root certificate expired on May 30, 2020

Technical Articles ID: KB92968
Last Modified: 6/17/2021

Environment

McAfee Agent (MA) 5.7.x, 5.6.x
McAfee ePO Cloud

Summary

McAfee Agent Smart packages (McAfeeSmartInstall.exe) downloaded or generated on or before May 30, 2020 fail to install.
This date corresponds to the expiration of the Root certificate. For details, see KB92937 - Secondary root certificate for TLS might need to be updated.

Subject	CN = AddTrust External CA Root OU = AddTrust External TTP Network O = AddTrust AB C = SE
Thumbprint	02faf3e291435468607857694df5e45b68851868
Expiration	Saturday, ‎May ‎30, ‎2020 4:18:38 PM

Problem

The McAfeeSmartInstall.log records the following errors during the SSL handshake to the ePO-Cloud server when downloading frameworkconfig.zip:

Mon Jun 01 20:54:57 2020 I Downloading FrameworkConfig.zip from https://161.69.29.169:443/config
Mon Jun 01 20:54:57 2020 I Fresh file will be downloaded at: C:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall\FrameworkConfig.zip
Mon Jun 01 20:54:57 2020 I certificate passed to curl
Mon Jun 01 20:54:57 2020 D curl Trying 161.69.29.169...
Mon Jun 01 20:54:57 2020 D curl TCP_NODELAY set
Mon Jun 01 20:54:57 2020 D curl Connected to 161.69.29.169 (161.69.29.169) port 443 (#0)
Mon Jun 01 20:54:57 2020 D curl ALPN, offering http/1.1
Mon Jun 01 20:54:57 2020 D curl Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
Mon Jun 01 20:54:57 2020 D curl successfully set certificate verify locations:
Mon Jun 01 20:54:57 2020 D curl CAfile: C:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall\cabundle.cera CApath: none
Mon Jun 01 20:54:57 2020 D curl TLSv1.2 (OUT), TLS header, Certificate Status (22):
Mon Jun 01 20:54:57 2020 D curl TLSv1.2 (OUT), TLS handshake, Client hello (1):
Mon Jun 01 20:54:58 2020 D curl TLSv1.2 (IN), TLS handshake, Server hello (2):
Mon Jun 01 20:54:58 2020 D curl TLSv1.2 (IN), TLS handshake, Certificate (11):
Mon Jun 01 20:54:58 2020 D curl TLSv1.2 (OUT), TLS alert, Server hello (2):
Mon Jun 01 20:54:58 2020 D curl SSL certificate problem: self signed certificate in certificate chain
Mon Jun 01 20:54:58 2020 D curl Closing connection 0
Mon Jun 01 20:54:58 2020 I Configuration request response code: 0
Mon Jun 01 20:54:58 2020 I Download of Frameworkconfig.zip Failed :0

In the McAfee Smart Installer user interface, you see a message that states:

Trying to download files directly from ePO
Trying to download files directly from ePO, Using Proxy
Unable to download files directly from ePO using proxy
Unable to download files via Proxy, Using Relay
Unable to download files via relay, download files failed
Error occurred during agent McAfeeSmartInstall operations

Cause

The McAfeeSmartInstall.exe packages generated before May 30, 2020 rely on an expired root certificate. As a result, the TLS connection fails when you try to download frameworkconfig.zip.

Solution

Replace any McAfeeSmartInstall.exe packages generated before May 30, 2020.

To generate a new Smart Installer.

Log on to ePO Cloud.
Navigate to the system tree and select the appropriate system tree subgroup as needed.
Select the Agent Deployment tab, and then select Create Agent Deployment URL.

NOTE: Existing Smart Install URLs are not impacted. Smart install packages downloaded via existing URLs continue to function normally.

Related Information

See also a related troubleshooting article:

KB93145 - Troubleshooting common issues for McAfee Smart Installer failure

Affected Products

ePO Cloud
McAfee Agent 5.7.x
McAfee Agent 5.6.x

Knowledge Center

McAfee Agent Smart Installs fail for ePO Cloud after a root certificate expired on May 30, 2020

Environment

Summary

Problem

Cause

Solution

Related Information

Affected Products

Title

Title

Knowledge Center

McAfee Agent Smart Installs fail for ePO Cloud after a root certificate expired on May 30, 2020

Environment

Summary

Problem

Cause

Solution

Related Information

Affected Products

Choose your region

Title

Title