Sometimes, the JSA custom SSL certificate reverts to the self-signed automatically. This article explains why and how to avoid the issue in future
This issue will occur when the system detects a certificate that is close to expiry, it will start to regenerate them which is what we see in the logs under /var/log/ca/localca.log:
time="2025-08-28T21:44:59+02:00" level=warning msg="Certificate /etc/pki/ca-trust/source/anchors/intermediate-qradar-ca_ca.crt is within the threshold 604800 to expire with 603704 away from expiry. Preparing to generate new certificate"
time="2025-08-28T21:44:59+02:00" level=debug msg="Certificate without CSR /etc/pki/ca-trust/source/anchors/intermediate-qradar-ca_ca.crt is close to expire. Regenerate the certificate"
time="2025-08-28T21:44:59+02:00" level=debug msg="Regenerating dependent certificate id=2, type=intermediate, file=/etc/pki/ca-trust/source/anchors/intermediate-qradar-ca_ca.crt, cfg=/opt/qradar/ca/conf/intermediate.json"
time="2025-08-28T21:44:59+02:00" level=debug msg="Start loading configurations from /opt/qradar/ca/conf/intermediate.json"
This defect was introduced in 7.5.0 UP10, and exists in 7.5.0 UP10 and UP11. The issue will be fixed as of 7.5.0 UP13.
Here is the work around you can apply which should also permanently resolve it. If you have your own custom certificates, you can skip to step 2, but the full workaround is listed:
Steps1:
1.) Check whether or not customer is using a custom SSL certificate for httpd.
openssl x509 -in /etc/httpd/conf/certs/cert.cert -noout -issuer
2.) Then reset all the certs:
sed -e "s@\"CertSkip\":[ \t]*\".*\"@\"CertSkip\": \"true\"@" -i /opt/qradar/ca/conf.d/httpd.json; /opt/qradar/ca/bin/reset-qradar-ca.sh all --reset
3.) Then restart all the QRadar services and clear the tomcat cache:
systemctl stop hostcontext tomcat hostservices; rm -rf /opt/tomcat/work/Catalina/localhost/console/org/apache/jsp ; systemctl daemon-reload; systemctl start hostservices tomcat hostcontext; $(locate wait_for_start.sh | tail -1)
Steps2:
In the event you have other customers hit this, and if they have a self signed certificate, this would be the work around for those systems. Do not run this one on this system if you are using custom certificate, this is just for your documentation:
1.) If the openssl command showed “QRadar Local CA”, we should be OK to fully reset all certs.
/opt/qradar/support/clear_csr.py
sed -e "s@\"CertSkip\":[ \t]*\".*\"@\"CertSkip\":\"false\"@" -i /opt/qradar/ca/conf.d/httpd.json; rm -rf /opt/qradar/ca/certs/*; /opt/qradar/ca/bin/reset-qradar-ca.sh all --reset