• The /opt/rsa/am/radius/securID_radius_connector.crt is expired.
• The RADIUS troubleshooting log (/opt/rsa/am/radius/radius.log) shows the following error:

rlm_perl: Exception when calling rsa_securid_mfa_call: Exception in rsa_securid_mfa_first_step_process_initialize when calling UserApi->initialize: API Exception(500): Can't connect to <FQDN of server>:60001 (certificate verify failed) Can't connect to <FQDN of server>:60001 (certificate verify failed) LWP::Protocol::https::Socket: SSL connect attempt failed error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed at /usr/lib/perl5/vendor_perl/5.18.2/LWP/Protocol/http.pm line 60. at /opt/rsa/am/radius/raddb/mods-config/perl/rsaMFA/UserApi.pm line 171.

• Alternatively, the failure message could be because there is an incorrect certificate is in the /opt/rsa/am/radius/securID_radius_connector.crt.

If the certificates are expired

1. Login to the Operations Console.
2. Navigate to Deployment Configuration > Certificates > Console Certificate Management.
3. Click Generate CSR to create a certificate signing request.
4. Fill out the required fields and click Generate File.
5. Click Download to get the .csr file.
6. Submit the CSR to your Certificate Authority (CA).
7. Download the CA root certificate.
8. Download any other certificates that are part of that signing chain if the SSL cert does not contain the complete chain.
9. Download the new SSL cert.
10. From Deployment Configuration > Certificates > Console Certificate Management you will start with the root cert and perform the following steps for each cert in the signing chain:
    1. Click Import Certificate.
    2. Under Certificate Basics, do one of the following:
       1. For a console certificate made in response to a CSR from the Operations Console. I
          • In the Import Certificate field, browse to the location where the certificate is stored. The file contains either a CA root certificate or the SSL cert form the CA.
          • For Type of Certificate to Import, select PKCS #7 (*.cer or *.p7b).
       2. For a console cert made in response to a CSR from a certificate tool of your choice, 
       • In the Import Certificate field, browse to the location where the certificate is stored. The file one or more certificates and the private key for the new certificate.
       • If the SSL certificate file contains the complete certificate chain up to  the CA root certificate. then import the PKCS #12 file.
       • In the Password field, enter the password for the PKCS #12 file.
11. Click Import.
12. To activate the certificate through the Operations Console,
    1. Go back to Deployment Configuration > Certificates > Console Certificate Management and, under Alias, click the name of the new SSL certificate.
    2. From the context menu, click Activate.
    3. On the Activate Certificate Confirmation page, review the certificate details to ensure that this is the certificate you wish to activate.
    4. Select Yes, make this the active certificate and click Activate Certificate. After the cert is activated, the Authentication Manager services automatically restart to complete the activation process. This can take several minutes. After services restart, login to the Operations Console and go to Deployment Configuration > Certificates > Console Certificate Management to confirm the new certificate is being used.

If the certificates are not expired

1. SSH to the primary Authentication Manager server.
2. Navigate to /opt/rsa/am/radius.
3. Run the command to list the certificates it contains:

4. Note the last few characters of the certificates shown.
5. Check communication with the following command:

6. Compare the last few characters of the certificates from the securID_radius_connector.crt to the last few characters of the certificates from the openssl output.
7. If they do not match, make a backup of the securID_radius_connector.crt:

8. Open the securID_radius_connector.crt with a text editor like vi.
9. Copy the text between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- for the certificates listed in the openssl command.
10. Paste the information between the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- values in the securID_radius_connector.crt.
11. Save and close the file with [ESC] :wq!
12. Restart RADIUS.

13. Try the connection again.