Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Resolving the Problem

Auto update 9.9 or earlier: " Could not retrieve signature for manifest errors"

Administrators on auto update version 9.9 or earlier can experience connection issues due to deprecated GPG keys. When older versions of auto update software attempt to connect to Juniper Cloud, a 'Could not retrieve signature for manifest file'. To resolve this error, administrators can run the JSA-AUProxyFP utility from Juniper Downloads page.

Error log example:

Procedure

  1. Use SSH to log in to the JSA console as the root user.

  2. Navigate to the /var/log/autoupdates directory.

  3. To locate the latest auto update log, type: ls -lart.

    The output displays the auto update logs by date. For example,

  4. Navigate to the directory with the most recent auto update log by date.

  5. Review the log for error messages. For example,

    Note:

    If the auto update version is 9.9 or earlier and the signature error is present in your auto update log, run the AUProxyFP-9.11 update.

  6. Download the Auto Update Fix Pack utility from Juniper Downloads page to your laptop or workstation:

    AUProxyFP.tgz

  7. Copy the file to a directory of the JSA Console, such as /root, /tmp, or /storetmp.

  8. Navigate to the directory with the AUProxyFP.tgz file.

  9. Type the following command to extract the file: tar -zxvf AUProxyFP.tgz

    If you experience an issue extracting the file with tar command, type: gunzip -c AUProxyFP.tgz | tar zxvf -

  10. Type the following command to install the proxy fix pack: ./install.sh

  11. In the Admin tab, click the Auto Update icon and click Get New Updates.

  12. Optional. After you start the auto update request, you can confirm your auto update version is updated.

    [root@qradar-lab]# /opt/qradar/bin/UpdateConfs.pl -v9.10

Results

Wait for the auto update to run and confirm the update is successful. If you continue to experience errors, contact Juniper Customer Support

Auto update 9.10 and later: " Bad signature, Rejecting the manifest errors"

Administrators on auto update version 9.10 or later can experience an issue where the au-cert.pem file is an old version, which can cause the server to return a 'Bad signature' error. If you experience this error, you can delete the au-cert.pem file from your Console and run a manual auto update.

Error log example:

Procedure

  1. Use SSH to log in to the JSA console as the root user.

  2. Navigate to the /store/autoupdates directory.

  3. Remove the file au-cert.pem file. For example, rm au-cert.pm.

  4. Run an auto update to receive an updated au-cert-chain.pem file.

    1. In the Admin tab, click the Auto Update icon and click Get New Updates.

      Or

    2. To start an auto update from the command line, type:

      /opt/qradar/bin/UpdateConfs.pl -ds runnow 1

Results

When the Console connects to the auto update server, it replaces the removed au-cert file with a new file named au-cert-chain. Wait for the auto update to run. If the auto update fails, administrators can run the AUProxyFP-9.11 utility. For information on running AUProxyFP-9.11, see Auto update 9.9 or earlier: "Could not retrieve signature for manifest errors" in this technical note. If you continue to experience errors, contact Juniper Customer Support.