IBM Support

QRadar: "Certificate expires soon" or "certificate is expired" alert for QRadar_SAML certificate when SAML authentication is not in use.

Troubleshooting


Problem

Administrators can receive a system notification about the QRadar_SAML certificate closed to expire or expired. The notification alerts occur despite SAML is not the authentication method configure on the system instructing the administrators to renew the certificate as soon as possible.
This article guides administrators to renew the certificate and stop the system notification to trigger.

Symptom

  • In the Console's user interface, a system notification shows a warning about certificate expiration.

    When the certificate is closed to expire, the following alert is received daily:
    The certificate named QRadar_SAML will expire on <date>. Please update the certificate soon.
    When the certificate is expired already, the following alert is received daily:
    The certificate named QRadar_SAML has expired. Please update the certificate as soon as possible.
  • Users might not log in to the Console's user interface, when default authentication is used.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB77","label":"Automation Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwsyAAA","label":"Admin Tasks"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions"}]

Log InLog in to view more of this document

This document has the abstract of a technical article that is available to authorized users once you have logged on. Please use Log in button above to access the full document. After log in, if you do not have the right authorization for this document, there will be instructions on what to do next.

Document Information

Modified date:
26 July 2022

UID

ibm16591107