Troubleshooting Tip: Resolving 'Invalid License' error due to SSL configuration issues in FortiSIEM

To resolve the 'Invalid License' error and SSL connection issues in FortiSIEM, follow these steps:

1. Verify that the license file is properly uploaded to the FortiSIEM server. Ensure that the license file is not corrupted and is in the correct format.
2. Check the SSL configuration on the FortiSIEM server. Ensure that the SSL certificates are properly installed and configured.
3. Try restarting the FortiSIEM services and check if the issue persists.
4. If the issue persists, change the internal SSL configuration to the default: 

1. From both Supervisor and Worker nodes, run the following against each other:

openssl s_client -connect <IP>:7900 -showcerts

2. If an outdated certificate is presented, inspect:

/opt/phoenix/config/phoenix_config.txt

3. Verify that the following parameters do not reference outdated certificates:

notification_client_cert_file
notification_client_key_file
notification_server_cert_file
notification_server_key_file

4. Update these parameters to match the default certificate paths used in the environment (no value means empty):

notification_client_cert_file=
notification_client_key_file=
notification_server_cert_file=/etc/pki/tls/certs/localhost.crt
notification_server_key_file=/etc/pki/tls/private/localhost.key

5. Remove deprecated CA references:

1. If SSL errors such as the following persist:

    

certificate verify failed

tlsv1 alert unknown ca

2. Check and clear the following parameters if they reference deprecated CA bundles:

notification_server_ca_file
notification_server_ca_dir

6. Revert /etc/httpd/conf.d/ssl.conf to the default configuration as seen below:

SSLCertificateFile /etc/pki/tls/certs/localhost.crt
SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
#SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt

7. Restart and validate:

1. Restart FortiSIEM services on all nodes.

2. Re-run the openssl s_client test to confirm:

   1. The correct certificate is presented.

   2. SSL handshakes are completed successfully.

   3. Supervisor and Worker nodes communicate normally.

In addition to these steps, it is also recommended to check the FortiSIEM logs (/opt/phoenix/log/phoenix.log) for any error messages related to the license or SSL configuration. This can help identify the root cause of the issue and provide more detailed information for troubleshooting.