Issue:

What is the correct way to combine certificate(s) and key into one file that can be imported into MSG?

Resolution:

The files provided by the Certificate Authority needs to be assembled in the following order: Appliance certificate, any intermediate certificate(s), Private key.
The data can be bundled together in your text editor of choice, and then saved as a .pem-file to be imported into the MSG appliance.
The end result might look something like this:

—-BEGIN CERTIFICATE—–

—–END CERTIFICATE—–
—-BEGIN CERTIFICATE—–

—–END CERTIFICATE—–
—-BEGIN PRIVATE KEY—–

—–END PRIVATE KEY—–

Issue:

• Universal CRT is not installed therefore Client Security or Server Security installation fails.
• In Policy Manger Console, push installations result in the status error message: "Installation failed. MSI error code is 1603".
• The following error can be seen in Windows Application Event Logs: "Product: F-Secure Client Security [Premium] 14.XX/F-Secure Server Security [Premium] 14.XX — Universal CRT is not installed".

Resolution:

The latest version of Client Security and Server Security require Windows Universal C Runtime to be installed on the system. Download and install Windows Universal C Runtime from the link here before installing Client Security or Server Security.

Here is also an alternate link from where to download Windows Universal C Runtime. Use this link, if a server operating system is used.
 

Issue:

• Firewall rules made with Policy Manager are not operational on Client Security or Server Security clients.
• Firewall rules pushed from Policy Manager to Client Security or Server Security clients do not appear / are not visible in the Windows firewall.

Resolution:

Check that you have edited the same firewall profile that is in use on the client. This can be done by following these steps:

1. Open Policy Manager Console
2. Select the host or domain from the Domain tree
3. Go to the Settings tab
4. Go to the Firewall page
5. Check that Host profile and Profile being edited match

If they match, the reason why the rule is not applied on the client is because it is an invalid rule. Invalid rules do not appear in the Windows Firewall. If the rule has many IP addresses in it, make sure that you have used a comma ( , ) in between each IP range as a value separator. Using a space or semicolon ( ; ) in between the IP ranges will invalidate the rule and it will not be visible in the Windows Firewall. 

Issue:

WithSecure Client Security or Server Security DataGuard blocks applications such as Firefox, OneDrive etc. that are installed to and running from the Users \ AppData folder on a Windows computer.

Resolution:

If the setting Discover trusted applications automatically is enabled, only applications that are installed under the 'default trusted locations' or utilizing 'default trusted processes' will be allowed to make changes to DataGuard Monitored folders automatically. The default trusted locations and processes are predefined as follows;
 

C:\PROGRAM FILES (X86)\
C:\PROGRAM FILES\
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\FILEMANAGER\PHOTOSAPP.EXE
C:\WINDOWS\NOTEPAD.EXE
C:\WINDOWS\SPLWOW64.EXE
C:\WINDOWS\SYSTEM32\MSPAINT.EXE
C:\WINDOWS\SYSTEM32\MSTSC.EXE
C:\WINDOWS\SYSTEM32\NOTEPAD.EXE
C:\WINDOWS\SYSTEM32\PICKERHOST.EXE
C:\WINDOWS\SYSTEM32\RUNTIMEBROKER.EXE
C:\WINDOWS\SYSTEM32\SEARCHPROTOCOLHOST.EXE
C:\WINDOWS\SYSTEM32\SIHOST.EXE
C:\WINDOWS\SYSTEM32\SNIPPINGTOOL.EXE
C:\WINDOWS\SYSTEM32\SPOOLSV.EXE
C:\WINDOWS\SYSTEM32\WFS.EXE
C:\WINDOWS\SYSTEM32\WRITE.EXE
C:\WINDOWS\SYSWOW64\EXPLORER.EXE
C:\WINDOWS\SYSWOW64\MSPAINT.EXE
C:\WINDOWS\SYSWOW64\MSTSC.EXE
C:\WINDOWS\SYSWOW64\NOTEPAD.EXE
C:\WINDOWS\SYSWOW64\PICKERHOST.EXE
C:\WINDOWS\SYSWOW64\SEARCHPROTOCOLHOST.EXE
C:\WINDOWS\SYSWOW64\WRITE.EXE
C:\WINDOWS\WRITE.EXE

Since the AppData folder is not on the list, applications installed to the AppData folder will be blocked by DataGuard.

Resolution is to either:

1. Uninstall the application from the AppData folder and to reinstall it to a trusted location such as C:\Program Files or C:\Program Files (x86) 
2. Add the application to the DataGuard Trusted applications list 

How to add the application to the DataGuard Trusted applications list:

1. Log in to the Policy Manager Console
2. Select a host or policy domain from the Domain Tree
3. Go to the Settings tab
4. Go to the DataGuard settings page
5. Scroll down to the Trusted applications table and click Add
6. Write the full application path to the Applications field
7. Distribute the policy (Ctrl + D)

Note: You can use system environment variables when you want to create an exclusion for many users. The supported environment variables are: %USERPROFILE%, %HOMEDRIVE%, %HOMEPATH%, %APPDATA%, %ProgramFIles%, %ProgramFiles(x86)% %ProgramData%, %windir%, %SystemRoot%, %SystemDrive%

Issue:

Client Security or Server Security is not able to connect to Policy Manager Server. 

Consequently, the client is unable to auto register itself to the Policy Manager Server and cannot download policies or upload status-information.

Resolution:

To troubleshoot similar connectivity issues, open the following file on the computer:

• C:\ProgramData\F-Secure\Log\BusinessSuite\pmpselectorplugin.log

Below is an example when communication with the PMS is working (PMS hostname is acme.com):

2019-03-08 09:08:34.991 [0e70.118c]  I: ***  LOGGING STARTED  *** (UTC+2:00, session: 0x0)
2019-03-08 09:08:35.283 [0e70.118c]  I: PmpSelectorPlugin::PluginMain: Starting: '100\PmpSelectorPlugin'
2019-03-08 09:08:35.284 [0e70.118c]  I: ServerFinder::ServerFinder: Last known good server is {host: acme.com, http: 80, https: 443}
2019-03-08 09:08:35.284 [0e70.118c]  I: `anonymous-namespace'::LoadPmsAddress: Forced PMS address loaded from cosmos: {host: acme.com, http: 80, https: 443}
2019-03-08 09:08:35.746 [0e70.118c]  I: ServerFinder::Find: Ping to {host: acme.com, http: 80, https: 443} failed
2019-03-08 09:08:42.801 [0e70.118c]  I: ServerFinder::Find: Ping to {host: acme.com, http: 80, https: 443} failed
2019-03-08 09:08:48.895 [0e70.118c]  I: UpdatablePmCertVerifier::RenewCertificates: Renewing certificates from acme.com
2019-03-08 09:08:49.436 [0e70.118c]  I: UpdatablePmCertVerifier::RenewCertificates: Certificates renewed successfully. Count: 2
2019-03-08 09:08:49.436 [0e70.118c]  I: CosmosUpdater::UpdateCosmos: Updating cosmos with PMS {host: acme.com, http: 80, https: 443}

Below is an example where communication is failing (PMS hostname acme2.com):

2019-03-01 12:32:56.185 [2b20.1a40]  I: ***  LOGGING STARTED  *** (UTC+5:30, session: 0x0)
2019-03-01 12:32:56.612 [2b20.1a40]  I: PmpSelectorPlugin::PluginMain: Starting: '100\PmpSelectorPlugin'
2019-03-01 12:32:56.614 [2b20.1a40]  I: ServerFinder::ServerFinder: Last known good server is {host: acme2.com, http: 80, https: 443}
2019-03-01 12:32:56.644 [2b20.1a40]  I: `anonymous-namespace'::LoadPmsAddress: PMS address loaded from cosmos: {host: acme2.com, http: 80, https: 443}
2019-03-01 12:32:56.653 [2b20.1a40] .W: ServerFinder::Ping: Ping to {host: acme2.com, http: 80, https: 443} aborted. There are no valid certificates
2019-03-01 12:32:56.653 [2b20.1a40]  I: UpdatablePmCertVerifier::RenewCertificates: Renewing certificates from acme2.com
2019-03-01 12:32:59.070 [2b20.1a40] *E: UpdatablePmCertVerifier::RenewCertificates: Failed to download certificate bodies. AsyncSendRequest failed: 12007

From the failed connection, the failure to connect is error 12007. Checking the Microsoft error-page:
 

• https://docs.microsoft.com/en-us/windows/desktop/winhttp/error-messages

Error 12007 translates to:

Additionally, you may run the Connectivity Tool to verify the current connectivity status to the Policy Manager Server. You can find this tool in the product settings window under Support > Tools, then click the Run connectivity tool button.

Issue:

After the file SHA-1 hash and file path is excluded in Client Security or Server Security versions 14 or 15, DeepGuard continues to block the application.

Resolution:

You can exclude a file or folder from Real-time scanning and Deepguard by following the steps below:

1. Log into Policy Manager Console
2. Click on Settings
3. Select Standard view
4. Select Real-time scanning
5. Scroll down to Files and applications excluded from scanning
6. Select Do not scan the following files and applications
7. Click Add
8. Enter the full path for each files, folder or SHA-1 of the application. 

• Select File path if the file that you want to exclude always uses the same path.
• Select Folder path if you want to exclude all files in a specific folder.
• Select Application SHA-1 if the path for the file that you want to exclude may vary across different hosts.

Note:

• If you are using F-Secure Client Security 13.10, kindly upgrade to the latest supported version since DeepGuard exclusions do not work in the 13.10 version.
• Wildcard exclusions are only applicable for Real-time scanning. For DeepGuard exclusions, kindly use file or folder path.
• F-Secure Security Cloud (ORSP) has a higher priority compared to SHA-1 exclusions. Only file or folder path exclusion has higher priority over ORSP.

If the application is still being blocked after following the steps above, kindly contact F-Secure Customer Care here for assistance.

Issue:

Logging in to the Policy Manager Console returns an error message: "F-Secure Policy Manager Console cannot start: internal error. See Administrator.error.log for more information."

The Administrator.error.log contains several SQL-related entries with "error code [1206]:The total number of locks exceeds the lock table size"

Resolution:

These SQL-errors are in most cases related to the value innodb_buffer_pool_size, and increasing this value usually fixes the issues. The value is verified by looking it up in the my.ini file on the MySQL-server, where it can also be increased as needed. 

Due to the large possible variations in user environments we are not able to give a direct number that this value should be set to. You can look for additional guidance from the MySQL Reference Manual and try an incremental approach, making several smaller changes and monitoring the results.

After modifying the value in the my.ini file, restart the MySQL-server and the Policy Manager Server to make sure everything is running with the latest configuration.

Note: Observe that getting or setting the value through Command line does not show or modify the correct value for every version of MySQL. To guarantee that the value is set correctly all changes need to happen via interaction with the my.ini file.

Issue:

When launching Citrix sessions/applications, the Business Suite Server Security or Email and Server Security system tray icon will also appear on the end-users machine, and will remain on the machine after closing the Citrix application. The F-Secure process for the user needs to be closed separately from the Citrix side to fully terminate the session.

Resolution:

To hide the system tray icon for Server Security 15 and later, disable the Show local user interface setting via Policy Manager:

1. Log in to Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Go to the Settings tab
4. Go to the Windows > Centralized management settings page
5. Scroll down to the Local user interface section
6. Uncheck the Show local user interface setting
7. Distribute the policy (Ctrl + D)

(Note: If needed, the administrator can open the user interface after changing Show local user interface setting. The administrator can run the fsmaincorporate.exe executable from the product installation folder: C:\Program Files (x86)\F-Secure\Server Security\ui\fsmaincorporate.exe)

The icon appears due to Citrix Seamless Configuration Settings. More information is available from the following link from Citrix:

https://support.citrix.com/article/CTX101644

One option to test is to disable the Citrix tray icon agent, which can be done by adding the following registry key to every VDA machine:

HKEY_LOCAL_MACHINE/System/CurrentControlSet/Control/Citrix/wfshell/TWI 
SeamlessFlags:REG_DWORD = 0x20

It is strongly recommended to familiarize yourself with the information from Citrix before testing the solution, and to do a small-scale test before deploying any changes to production.

Issue:

Best Practice Upgrading Policy Manager from Version 15.x to 16.x – Step-by-Step Guide

Resolution:

This following guide provides step-by-step instructions on upgrading your F-Secure Policy Manager from version 15.x to version 16.x. Please ensure that you have backed up your system before proceeding with this upgrade.

1. Backup Your System:
   – Create a system backup. If you're running a virtual machine, create a snapshot.
   – At a minimum, ensure that you have a backup of the Policy Manager Server folder.

2. Stop the Policy Manager Server Services:
   – Open the command prompt.
   – Execute the command: net stop fsms

3. Copy the Following Content:
   – Copy the specified content from your existing installation:
     – `?:\Program Files (x86)\F-Secure\Management Server 5\data\events\`
     – `?:\Program Files (x86)\F-Secure\Management Server 5\data\guts2\`
     – `?:\Program Files (x86)\F-Secure\Management Server 5\data\h2db\`
     – `?:\Program Files (x86)\F-Secure\Management Server 5\data\fspms.jks`
     – `?:\Program Files (x86)\F-Secure\Management Server 5\data\fspms.db.config`
     – `?:\Program Files (x86)\F-Secure\Management Server 5\data\fspms.proxy.config`
     – `?:\Program Files (x86)\F-Secure\Management Server 5\data\fspms-ca.jks`
     – `?:\Program Files (x86)\F-Secure\Management Server 5\data\sdata`

4. Uninstall the Older Version:
   – Uninstall the previous version of Policy Manager (15.x).

5. Download and Install the Latest Version:
   – Download the latest version of Policy Manager (16.x) and install it on your machine.

6. Stop Policy Manager Server 16 Services:
   – Open the command prompt.
   – Execute the command: net stop wspms

7. Move/Paste Copied Content:
   – Paste the content you copied in step 3 to the following path:
     – `C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\data\events\`
     – `C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\data\guts2\`
     – `C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\data\h2db\`
     – `C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\data\fspms.jks`
     – `C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\data\fspms.db.config`
     – `C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\data\fspms.proxy.config`
     – `C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\data\fspms-ca.jks`
     – `C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\data\sdata`

8. Execute the Maintenance Tool:
   – Run the maintenance tool located at: `C:\Program Files\WithSecure\Policy Manager\Policy Manager Server\bin\fspms-db-maintenance-tool`

9. Check and Ensure Port Settings:
   – Verify that the HTTPS and HTTP ports are correctly defined in the registry and match the settings from the previous F-Secure installation.
   – For version 15.00 (and older), check the settings in the `?:\Program Files (x86)\F-Secure\Management Server 5\config.txt` file.
   – For version 16.00 (and newer), check the registry location: `HKEY_LOCAL_MACHINE\SOFTWARE\WithSecure\Policy Manager\Policy Manager Server\`

10. Restart Policy Manager Services:
    – Open the command prompt.
    – Execute the command: net start wspms

Note:
– Replace "?" with the source drive for your previous Policy Manager installation. If you're unsure where the old version is installed, check the following registry key: `HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Data Fellows\F-Secure\Management Server 5\InstallationDirectory`.
– For example: `E:\Program Files (x86)\F-Secure\Management Server 5` indicates the target source drive as E:.

Issue:

After upgrading to Policy Manager 15.x, Client Security or Server Security hosts show disconnected status or are missing in the Policy Manager Console.

AsyncSendRequest SSL fail: 12175  is logged in the pmpselectorplugin.log or nrb.log:

I: UpdatablePmCertVerifier::RenewCertificates: Renewing certificates from 192.168.98.247:9443 with HTTP proxy ''
*E: UpdatablePmCertVerifier::RenewCertificates: Failed to download certificate bodies (FsHttpRequest::Error_Certificate, AsyncSendRequest SSL fail: 12175 [0x80000000])
.W: PmpSelectorPlugin::Run: Policy Manager unavailable

Visible symptoms:

• The host is not able to receive policy updates from the Policy Manager Server
• Policy Manager Console Centralized management status page shows Policy counter on the host and on the server do not match (policy in use is not the latest)
• The host is shown in disconnected status in the Policy Manager Console domain tree
• AUA.log on the host shows it is able to connect to the Policy Manager Server using HTTP to download updates

Resolution:

Policy Manager 15.x dropped the support for weak cipher suites (TLSv1 and TLSv1.1) for TLS protocol. This may result in connectivity issues with outdated Windows hosts that are missing e.g. KB3042058 updates from May 2015. Hosts with Windows 7, 8, 8.1, Server 2008 R2, Server 2012 or Server 2012 R2 are affected by this issue.

The download links and more information, including prerequisites for KB3042058 are available here. The update adds additional cipher suites to the default list on affected systems and improves cipher suite priority order.

The easiest way to verify if the host is able to use the Policy Manager Server SSL connector or not, is to load the Policy Manager Server page via HTTPS (port 443 in default config) with Microsoft Internet Explorer from the managed host. 

1. Open Microsoft Internet Explorer
2. Go to address https://<YourPolicyManagerServerAddress>:443 

If the connection works, you should see a message that tells you the Policy Manager Server is installed and is working fine. 

Microsoft Internet Explorer browser is used because it is the only browser using the same secure channel library as the clients under Windows to establish a secure connection with the Policy Manager Server. Other browsers might establish that secure connection with an integrated library to the Policy Manager even without KB3042058.

If the issue is spotted on a newer Windows operating system, you will need to verify whether the cipher suites supported on the Policy Manager Server, are supported on the host. You can do the following to find out:

To fetch list of cipher suites supported for Policy Manager Server, install Nmap and run the following on a host where Policy Manager Server is reachable:

• nmap –script ssl-enum-ciphers -p <HTTPS port for Host Module> <Policy Manager Server hostname or IP address>

To fetch a list of cipher suites supported on the host, run the following in Windows PowerShell on Server 2016 and newer:

• Get-TlsCipherSuite

Sometimes 'schannel' library is attempting to use TLS 1.0 even with the KB3042058 update installed. It was discovered that this can happen if the Windows Server is running in an Active Directory role. Making any changes to SSL Cipher Suite Order Group Policy setting as described in More Information at https://support.microsoft.com/en-us/help/3042058/microsoft-security-advisory-update-to-default-cipher-suite-priority-or#section-2 and rebooting the server fixes this, even if SSL Cipher Suite Order Group Policy setting value is later reset to default.

If you are unable to install the cipher suites Windows update on the host or fix the SSL Cipher Suite Order Group Policy setting, a workaround would be to allow TLSv1 and TLSv1.1 for the Policy Manager Server by using these steps:

1. Stop the Policy Manager Server service using command prompt command:
   • For Policy Manager 15: net stop fsms
   • For Policy Manager 16: net stop wspms
2. Open Regedit and navigate to:
   • Policy Manager 15: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Data Fellows\F-Secure\Management Server 5\
   • Policy Manager 16: HKLM\SOFTWARE\WithSecure\Policy Manager\Policy Manager Server\
3. Open the additional_java_args string and add: -DenableVistaInteroperability=true
4. Start the Policy Manager Server service using command prompt command:
   • For Policy Manager 15: net start fsms
   • For Policy Manager 16: net start wspms

Now hosts using TLSv1 and TLSv1.1 will be again able to connect to the Policy Manager Server and download policies.