|
To resolve the 'Invalid License' error and SSL connection issues in FortiSIEM, follow these steps:
- Verify that the license file is properly uploaded to the FortiSIEM server. Ensure that the license file is not corrupted and is in the correct format.
- Check the SSL configuration on the FortiSIEM server. Ensure that the SSL certificates are properly installed and configured.
- Try restarting the FortiSIEM services and check if the issue persists.
- If the issue persists, change the internal SSL configuration to the default:
- From both Supervisor and Worker nodes, run the following against each other:
openssl s_client -connect <IP>:7900 -showcerts
-
If an outdated certificate is presented, inspect:
/opt/phoenix/config/phoenix_config.txt
-
Verify that the following parameters do not reference outdated certificates:
notification_client_cert_file
notification_client_key_file
notification_server_cert_file
notification_server_key_file
-
Update these parameters to match the default certificate paths used in the environment (no value means empty):
notification_client_cert_file=
notification_client_key_file=
notification_server_cert_file=/etc/pki/tls/certs/localhost.crt
notification_server_key_file=/etc/pki/tls/private/localhost.key
-
Remove deprecated CA references:
-
If SSL errors such as the following persist:
certificate verify failed
tlsv1 alert unknown ca
-
Check and clear the following parameters if they reference deprecated CA bundles:
notification_server_ca_file
notification_server_ca_dir
-
Revert /etc/httpd/conf.d/ssl.conf to the default configuration as seen below:
SSLCertificateFile /etc/pki/tls/certs/localhost.crt
SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
#SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt
-
Restart and validate:
-
Restart FortiSIEM services on all nodes.
-
Re-run the openssl s_client test to confirm:
-
The correct certificate is presented.
-
SSL handshakes are completed successfully.
-
Supervisor and Worker nodes communicate normally.
In addition to these steps, it is also recommended to check the FortiSIEM logs (/opt/phoenix/log/phoenix.log) for any error messages related to the license or SSL configuration. This can help identify the root cause of the issue and provide more detailed information for troubleshooting.
|
