Windows Patch Assessment failing

[WTargarean]

We have a few servers failing on Windows Patch Assessment. Certs are installed, tried uninstalling and reinstalling the agent. still failing.

attached is a the logs screenshot:
 

[Igor Perevozchikov]

Hi WTargarean!

Probably you have a same symptoms as described in this KB Article:
https://knowledge.broadcom.com/external/article/164743/windows-system-assessment-scan-fails-wit.html

Best regards,
IP.

[Craig Witter]

We ran into this over the last weekend too. You likely need this certificate: https://cacerts.digicert.com/DigiCertTrustedRootG4.crt

It looks like they have changed how their signing is being done as of March 2023: https://knowledge.digicert.com/generalinformation/digicert-root-and-intermediate-ca-certificate-updates-2023.html 

[Fabian De Reyst]

Hi all,

we have the same issue! installing the new certificate didn't work. Then I saw that we only have issues on the machines that have no internet access. So just enabled internet access for a few minutes, opened a browser to whatever website, closed it and after that patch assessment scan was resolved. could it be an issue caused by CRL lookup?

[cookie999]

We are also seeing the same issue.  However, we are not in a position to be able to give all our server estate access to the internet. We can definitely see where the limited number of servers and workstations that do have internet access are working with no issue, guessing as you say, they can perform CRL lookups.  

[Dmitri Gornev]

We plan to update KB164743 shortly with new certificates information but here is the short summary.
The following certificates need to be installed on affected computers (according to our investigation these are endpoints that don't have access to Internet):

https://cacerts.digicert.com/DigiCertTrustedRootG4.crt to Trusted Root Certification Authorities
http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt to Intermediate Certification Authorities

The easiest way to distribute them to numerous endpoints is using Notification Server Connection Profile functionality - it has an ability to transfer certificates to the managed endpoints and install to appropriate certificate stores there:

[AlexS@ProximusLux]

Hello,

What is the required password ?

[Roy B]

Alex,

The files I downloaded were a .crt.  Importing a .crt didn't require a password for me. Looks like you're importing a .cer file?

Both certificates imported correctly:

Hope that helps,
Roy

[AlexS@ProximusLux]

Hello Roy,

yes with CRT name, it works correctly without requesting a password. Thank you for your help
Alex

[Jacques Bence]

I am seeing the same issue on my side.  However, I am not using a certification infrastructure and I am also not able to allow all machines access to the internet.  It doesn't even work on my NS and SQL server.  So where to from here?

[Dmitri Gornev]

Hi Jacques,

please check KB164743 - it currently contains two options how to install the required certificates and we're looking into possibility to automate the process.

Best regard,
Dmitri.

[cookie999]

We following the KB https://knowledge.broadcom.com/external/article/164743/windows-system-assessment-scan-fails-wit.html and then downloaded all the certs.  Then as per method 3 in the KB, we deployed via the NS Communication Profile - our servers also don't have internet access, but this method worked for us.  We are now up and running again.

[Jacques Bence]

As mentioned before we are not running in HTTPS or SSL mode so we are not using certificates in the environment. I have no existing certificates to replace and I don't intend on enabling HTTPS mode either.  Any other suggestions?

[Jacques Bence]

I got mine to work now by downloading the certs and adding them to the SSL settings as described in the article.  The logs showed that the certs are being replaced on the client machine and then the patch scan was able to complete.  I did not have to touch the HTTPS settings.

[Dmitri Gornev]

KB164743 is updated with additional resolution options.

[WTargarean]

Thank you! everything is working

[Igor Perevozchikov]

Just in case, there is a custom inventory available to get information about installed certificates in trusted root and CA from managed client computers, to make sure that all computers have required certificates installed

https://community.broadcom.com/symantecenterprise/viewdocument/custom-inventory-to-get-installed-c?CommunityKey=bf23126f-6eab-4bbe-965d-e26838c079e0&tab=librarydocuments

[WTargarean]

This is helpful, Thank you Igor!