Further to the information regarding allowing CRL checks in firewalls, we have discovered that some devices still fail to connect in some scenarios, particularly where a proxy is used. This appears to be an issue with how the System processes access the proxy.
To resolve this issue, we have identified so far two possible solutions
We have received some reports that F-Secure Elements Agent is unable to update its status in the Elements portal, or to make changes to the assigned profiles.
After investigation, it was determined that this issue was introduced in the release of the F-Secure Elements Agent version 22.1, released on 21 January 2022. This release included a new check which contacts CRL servers, related to the validity check of TLS certificates used.
We will update the release notes for this version, and add the following information:
Connectivity requirements changed: Please note that we do require connection to CRL URLs now. Please verify that connections to the following CRL URLs work:
If you see that the client status is not updating in the portal, or profile changes are not applied to the client, please open HTTP connections to the CRL URLs.
At no time was the security of the device affected by this change. All detections and network connections to F-Secure Security Cloud continued to work as expected.
Posted Feb 03, 2022 - 10:56 UTC
Identified
We have received some reports that F-Secure Elements Agent is unable to update its status in the Elements portal, or to make changes to the assigned profiles.
After investigation, it was determined that this issue was introduced with the release of the F-Secure Elements Agent version 22.1, on 21 January 2022. This release included a new check which contacts a CRL server, related to the validity check of TLS certificates used.
Connectivity requirements changed: Please note that we do require connection to CRL URLs now. Please allow HTTP connectivity to crl.sca1b.amazontrust.com and verify that connections to CRL URLs work (like http://crl.sca1b.amazontrust.com/sca1b-1.crl). If you see that clients cannot send data to portal anymore then most likely CRL URL is blocked.