Issue:

I executed fspmp-enroll-tls-certificate.bat for Policy Manager Proxy and it gives me the error "Error: CA certificate verification failed" or "RA not issued by CA".

Resolution:

This error can occur if the server's Simple Certificate Enrollment Protocol (SCEP) is not up to date. You can follow the steps below on the Policy Manager Server to resolve this:

1. Launch Command Prompt as administrator
2. Type net stop fsms and hit Enter to stop Policy Manager Server services
3. Delete the fspms.jks file from the Policy Manager Server installation folder (…\F-Secure\Management Server 5\data)

4. In Command Prompt, navigate to the folder mentioned in Step 3. 

5. Type the following command below one after another: 

• C:\Program Files (x86)\F-Secure\Management Server 5\jre\bin\keytool.exe" -delete -alias fspm-ra-encryption -keystore fspms-ca.jks
• C:\Program Files (x86)\F-Secure\Management Server 5\jre\bin\keytool.exe" -delete -alias fspm-ra-signing -keystore fspms-ca.jks 

6. Type net start fsms and hit Enter to stop Policy Manager Server services

Last, you need to run the fspmp-enroll-tls-certificate.bat script located in the Policy Manager Proxy Server installation folder. (…\F-Secure\Management Server 5\bin\fspmp-enroll-tls-certificate.bat), and restart PMP service.

For Linux

The main issue is the CA certificate was updated, but SCEP certificates were not on the Policy Manager.

So to fix the issue we should delete Simple Certificate Enrollment Protocol (SCEP) certificates from fspms-ca.jks.
 

On Policy Manager Server machine:

   1) stop FSPMS service;
   2) delete fspms.jks ;
   3) run under data folder (/var/opt/f-secure/fspms/data/ ) next:
      – /opt/f-secure/fspms/jre/bin/keytool -delete -alias fspm-ra-encryption -keystore fspms-ca.jks
      –  /opt/f-secure/fspms/jre/bin/keytool -delete -alias fspm-ra-signing -keystore fspms-ca.jks ;
   4) start FSPMS service

On Policy Manager Proxy machine :run fspmp-enrol- tls-certificate script (/opt/f-secure/fspms/bin/), and restart PMP service.

Issue:

What ports are used for communication between Policy Manager Server and Linux Security 64 ?

Resolution:

Check connectivity from host to Policy Manager Server using HTTP Browser. If your Linux host does not have GUI, check connectivity using these commands:

curl -o https-host -k  https://:PMS_address:port_number
curl -o http-host http://:PMS_address:port_number

Linux Security 64 uses HTTP and HTTPS connections, therefore port numbers that are set for these protocols needed to be allowed.
By default, these are the port numbers:
HTTP : 80
HTTPS : 443

The same port is used for:

• downloading updates,
• downloading base-policies from the Policy Manager Server (settings),
• uploading status information to the Policy Manager Server.

Issue:

When trying to uninstall WithSecure Policy Manager from a Windows Server, uninstallation fails due to "Unable to load the uninstallation plugin DLL" error-message.

Resolution:

This error message occurs, when the server hosts an old, unsupported version of WithSecure Policy Manager or the installation has been partially corrupted.

There are two options to solve this issue:

1. Install the latest version of Policy Manager. After the upgrade, uninstallation should work correctly.
2. Remove the old Policy Manager using the Uninstallation tool.

NOTE: The Uninstallation Tool should be only used as a last resort and at your own risk.

Issue:

Why is the Software Updater button missing from the WithSecure Client Security main user interface? 

Resolution:

Do note that Software Updater feature is only available on Premium version of Client Security and Server Security. You may refer to our release notes here:

https://help.f-secure.com/product.html?business/releasenotes-business/latest/en/fsss-latest-en

https://help.f-secure.com/product.html?business/releasenotes-business/latest/en/fscs-latest-en

If the Software Updater button is not shown for local users in the user interface, it has been most likely disabled from the policy. 

Follow these steps to enable the Software Updater user interface for the local users:

1. Log in to the Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Go to the Settings tab (standard view)
4. Go to the Software Updater settings 
5. Enable the setting Show Software Updater options to users
6. Distribute (Ctrl+D) the policy

Once the policy has been received by the clients, users will be able to see the Software Updater button in the main user interface. Using the Software Updater local feature, the users can see which updates are available and select to install them on their computers. 

Issue:

When exporting Client Security for Windows / Mac or Server Security 16 installer for local installation, push installation or upgrade, the HTTP,/ HTTPS ports and the Policy Manager server addresses are grayed out. 

Resolution:

This is by design. The Policy Manager Server address and the HTTP / HTTPS ports need to be pre-configured from the policy before continuing with the installation wizard. We recommend to not leave the ports and addresses blank or empty on the root level. 

Follow these steps:

1. Log in to the Policy Manager Console 
2. Select either Root, Policy domain or single host from the Domain tree 
3. Go to the Settings tab
4. Go to the Centralized management settings
5. Enter the Policy Manager Server address, HTTP and HTTPS ports
6. Distribute the policy (Ctrl + D)

Then you can select the policy with the correct Policy Manager Server address and ports in the Initial policy step of the installation wizard:

• Select Default policy if you have set the address and ports for the whole Root 
• Select Policy for and select the policy domain or host if the settings have been created for a specific policy domain or host

Once it is done, you may proceed with the exporting of our product installer, where the Policy Manager Server address and HTTPS port are displayed according to your configurations in the policy.

Issue:

What is considered "new infection" in the F-Secure Policy Manager Web Reporting view?

Resolution:

1. Log on to your Policy Manager Console
2. Select the Policy domain or Host you want to edit
3. Switch to the Alerts tab
4. Every item in the list, which is not marked as "read" will be considered as "new" in the Web Reporting

Note: As long as an item in the Policy Manager Console Alerts list is not marked as "read", it will appear in the Web Reporting in the list for "New top 10" and "New infection details".

Issue:

What happens when the F-Secure Messaging Security Gateway (MSG) license has expired or been deactivated? Will emails be blocked or bypass the MSG appliance?

Resolution:

In the event that the MSG license has expired or been deactivated, for license migration purposes. The appliance itself will keep functioning:

• Mails will not be blocked, mail will flow normally
• The appliance will not receive Anti-Virus or spam-definitions 
• Some modules will not be accessible, for example Smart Search and Encryption
• Current rules in place will still be applied

Issue:

The network access requirements for F-Secure Linux Security 64 (LS 64) installation and normal operation

Resolution:

Below are the requirements for network access when you install F-Secure Linux Security 6 as centrally managed mode:

1. HTTPS

• *.fsapi.com
• *.sp.f-secure.com
• Policy Manager Server address (applicable in case of Policy Manager managed installation)

2. HTTP:

• guts2.sp.f-secure.com
• *.orsp.f-secure.com
• orsp.f-secure.com
• Policy Manager Server address (applicable in case of Policy Manager managed installation)

Issue:

What are the main differences between WithSecure Linux Security 64 and WithSecure Linux Security 11.x?
 

Resolution:

Linux Security 64 is a native 64-bit application, however there are some differences compared to the previous released version Linux Security 11.x, most notably:

• no support for Protection Service for Business (PSB) installation mode
• no firewall
• no web user interface (for remote management with browser)
• no support for unattended (scripted) installations

The list of supported Linux distributions is also different with some legacy distributions only being supported by Linux Security 11.x. 
Also note, that while the installer for Linux Security 64 is created / exported in Policy Manager Console, neither Linux Security 11 nor Linux Security 64 can be deployed / pushed to hosts using Policy Manager Console.

Issue:

Where can I find the WithSecure Policy Manager Server's management public key (admin.pub) used by clients to verify the validity of distributed policies?

Resolution:

You can export the public key (admin.pub) from the Policy Manager Console. To do so, follow the steps below:

Method A – Export the key with the WithSecure Policy Manager Console

1. Log on to your WithSecure Policy Manager Console.
2. From the top menu panel, select Tools > Server Configuration….
3. Select the Keys tab.
4. Under "Export signing keys", select the button Export….

Method B – Downloading the key from the WithSecure Policy Manager Server

From any of the managed hosts:

1. Open a web browser.
2. In the address bar type in the address of the WithSecure Policy Manager Server that this host is connected to, for example:

   https://fspms-local.example:443

3. If the connection to your WithSecure Policy Manager Server is successful, a web page indicating that the Policy Manager Server is operating correctly is shown.
4. Find the paragraph about the "WithSecure Policy Manager Server's public key".
5. Download the key from the highlighted download button/hyperlink (here) in that paragraph.