Updating the server certificate on the management server without breaking communications with the client
Symantec Endpoint Protection Manageruses a certificate to authenticate communications between it and the
Symantec Endpoint Protectionclients. The certificate also digitally signs the policy files and installation packages that the client downloads from it. The clients store a cached copy of the certificate in the management server list. If the certificate is corrupted or invalid, the clients cannot communicate with the server. If you disable secure communications, then the clients can still communicate with the server, but do not authenticate communications from the management server.
You disable secure communications to update the certificate in the following situations:
- A site with a singleSymantec Endpoint Protection Manager
- A site with more than oneSymantec Endpoint Protection Manager, if you cannot enable failover or load balancing
If the certificate is corrupted but otherwise still valid, you can perform disaster recovery as a best practice. See:
After you update the certificate and the clients check in and receive it, enable secure communications again.
When you update the certificate on a site with multiple management servers and use failover or load balancing, the certificate updates on the management server list. During the process of failover or load balancing, the client receives the updated management server list and the new certificate.
- To update the server certificate on a single management server site without breaking communications with the client
- In the console, clickPolicies > Policy Components > Management Server Lists.
- UnderTasks, clickCopy the List, and then clickPaste List.
- Double-click the copy of the list to edit it, and then make the following changes:
- ClickUse HTTP protocol.
- For each server address underManagement Servers, clickEdit, and then clickCustomize HTTP port.Leave it at the default of 8014. If you use a custom port, use it here.
- ClickOK, and then clickOKagain.
- Right-click the copy of the list, and then clickAssign.
- On the console, clickClients > Policies > General.
- On theSecurity Settingstab, uncheckEnable secure communications between the management server and clients by using digital certificates for authentication, and then clickOK.
- Wait at least three heartbeat cycles after making this change on all groups before you move to step 9.Make sure that you also configure this setting for the groups that do not inherit from a parent group.
- Update the server certificate. See:
- ClickOK.To reenable the original settings, wait at least three heartbeat cycles, recheckEnable secure communications between the management server and clients by using digital certificates for authentication, and then reassign the original management server list back to your groups.
- To update the server certificate on a multi-management server site without breaking communications with the client, in the console, ensure that your clients are configured to load balance or failover to at least one otherSymantec Endpoint Protection Manager. See:If you cannot enable load balancing or failover, use the single management server site procedure to first disable then reenable secure communications.Due to a change in the communication module, client versions 14.2.x cannot use this method to update the server certificate. To avoid breaking communication with these clients, use the single management server site procedure for these client versions, even for multi-management server sites.
- Update the server certificate onSymantec Endpoint Protection Manager. See:
- Wait at least three heartbeat cycles, and then update the server certificate on the nextSymantec Endpoint Protection Manageron the site.
- Users who are out of the office or on leave may not receive these updates on their device because it is offline. Many institutions run the failover method for 30 days or more to catch as many out-of-office clients as possible. You may want to leave oneSymantec Endpoint Protection Managerrunning for 90 days with the old certificate to ensure that those users are not orphaned.