Security

 View Only

  • 1.  ClearPass Policy Manager 6.14 Release Announcement(s)

    Posted May 29, 2026 03:09 PM

    Hello All,

    We are pleased to announce the immediate availability of ClearPass Policy Manager 6.14.0!  In addition to bug fixes, this release also includes several new features that our Engineering and QA team have worked tirelessly to include:

    Enhanced Cryptography & Security

    Why is this interesting? ClearPass is now Post-Quantum Cryptography (PQC) ready.  This allows the use of new cryptographic functionality today in HTTPS and will enable the use of other protocols during the 6.14 release lifetime.  ClearPass also now fully supports the use of EAP-TLS with TLSv1.3, including the latest capabilities being released with endpoint supplicants. Hardware-backed key material is now available to further safeguard key materials using by ClearPass with either TPM or HSM support.

    New Hypervisor Support – Nutanix Acropolis™ (AHV)

    Why is this interesting? Customers are now able to operate KVM images on Ubuntu, RHEL, and Nutanix underlying base OS versions for their virtualization offerings.

    Generic OIDC Authentication

    Why is this interesting? ClearPass has supported many authentication offerings for portals, but with many industry and commercial solutions now also moving to the Open ID Connect (OIDC) standard, ClearPass Guest can now use any solution, local or on-prem, to authenticate users within portals.

    TLS-encrypted Syslog

    Why is this interesting? Customers are moving more of their SIEM solutions to cloud-based offerings.  IPsec security remains the gold standard, but it is difficult to use with cloud-SIEM offerings.  TLS-encryption allows the Syslog messages to be securely exchanged for these offering.

    As always, please take note of the 'Changes of Behaviors' section of the release notes https://www.arubanetworks.com/techdocs/ClearPass/CP_ReleaseNotes_6.x.x/Default.htm 

    The upgrade images have been posted Networking Support Portal (NSP) and the software updates portal.

    A big thanks and congratulations to the ClearPass Engineering, ClearPass QA and TechPubs teams for reaching this milestone!

    Best regards,

    The ClearPass Team



    -------------------------------------------


  • 2.  RE: ClearPass Policy Manager 6.14 Release Announcement(s)

    Posted Jul 13, 2026 03:13 AM
    Edited by GK-c34688 Jul 13, 2026 03:15 AM

    Hi Team.

    I'm using AP factory certificates for dot1x authentication of APs. With 6.14 requirements to disable/remove SHA1 CA certificates those APs can't authenticate any more. Currently I tested AP-315 and AP-505H.  

    EAP-TLS: fatal alert by server - unknown_ca
    TLS Handshake failed in SSL_read with error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed
    eap-tls: Error in establishing TLS session

    For test I disabled following certificates from Trust list and APs were not able to connect any more.

     

    Weekly SHA1 certificate algorithm compliance check summary for upgrade readiness.
    Blocking findings: 5

    Blocking findings:
    1. [Trust List] CN=DEVICE-CA1,DC=ca,DC=arubanetworks,DC=com | owner=default | status=enabled | algorithms=sha1withrsaencryption | reason=default enabled deprecated certificate remains in Trust List
    2. [Trust List] CN=Aruba Networks Trusted Computing Policy CA 1.0,OU=Operations,OU=DeviceTrust,O=Aruba Networks,C=US | owner=default | status=enabled | algorithms=sha1withrsaencryption | reason=default enabled deprecated certificate remains in Trust List
    3. [Trust List] CN=VeriSign Class 1 Public Primary Certification Authority - G3,OU=(c) 1999 VeriSign\\, Inc. - For authorized use only,OU=VeriSign Trust Network,O=VeriSign\\, Inc.,C=US | owner=default | status=enabled | algorithms=sha1withrsaencryption | reason=default enabled deprecated certificate remains in Trust List
    4. [Trust List] CN=device-ca5,DC=dc-device-ca5,DC=arubanetworks,DC=com | owner=default | status=enabled | algorithms=sha1withrsaencryption | reason=default enabled deprecated certificate remains in Trust List
    5. [Trust List] CN=Aruba Networks Trusted Computing Root CA 1.0,C=US,O=Aruba Networks,OU=Operations,OU=DeviceTrust | owner=default | status=enabled | algorithms=sha1withrsaencryption | reason=default enabled deprecated certificate remains in Trust List

     

    Best, Gorazd



    ------------------------------
    Gorazd Kikelj
    MVP Guru 2025
    ------------------------------



  • 3.  RE: ClearPass Policy Manager 6.14 Release Announcement(s)

    Posted 29 days ago

    Hello!

    How to remove the error message? :

    Weekly SHA1 certificate algorithm compliance check found 8 blocking finding(s); see Event Viewer for complete details; upgrade to 6.14 will be blocked in the current state."

    I disabled all the certificates SHA1 and the message stay there.

    Thank you


    Original Message


  • 4.  RE: ClearPass Policy Manager 6.14 Release Announcement(s)

    Posted 29 days ago

    You need to remove the certificates, disable is not enough to get rid of the warning and enable update to 6.14.

    But as Gorazd highlights, some Aruba devices have factory certificates with SHA1 in the chain. This can be a huge issue for organizations on slightly older but still supported hardware.



    ------------------------------
    Best Regards
    Jonas Hammarbäck
    MVP Guru, ACEX, ACDX #1600, ACCX #1335, ACX-Network Security
    Aranya AB
    If you find my answer useful, consider giving kudos and/or mark as solution
    ------------------------------

    Original Message


  • 5.  RE: ClearPass Policy Manager 6.14 Release Announcement(s)

    Posted 29 days ago

    Your test is the post-upgrade state, so there's nothing to keep. The 6.14 known issues say upgrade is blocked if default SHA-1 certs are present and enabled, disabled ones are deleted after user verification, and after a successful upgrade no SHA-1 certificates are retained.

    Worth trying first: the Trust List page documents eight CAs added disabled by default, three of them Aruba Networks Trusted Computing Issuing CA 4, 5 and 6, plus Platform Root CA 1.0. That's a parallel hierarchy to the DEVICE-CA1 and Trusted Computing Root CA 1.0 set you had to kill. Check their signature algorithm, enable them, retest.

    If the 315s and 505Hs still chain to the old CAs, the Trust List won't save them and the documented route is off factory certs. Central's AP certificate mapping describes that move, a group using the TPM factory certificate for AP1X switching to a customer user certificate, with EST for provisioning. Access Tracker shows which issuer each AP presents, and that decides which case you're in.



    ------------------------------
    Dustin Burns
    @Worldcom Exchange, Inc.
    www.wei.com

    - - -
    The comments I post here are my own, and not my employers
    If my post was useful accept solution and/or give kudos
    Personal Blog: www.networkfieldnotes.com
    - - -
    ------------------------------

    Original Message


  • 6.  RE: ClearPass Policy Manager 6.14 Release Announcement(s)

    Posted 25 days ago

    Although this mostly plays with uplink 802.1X for 'older' APs (and other devices that have a SHA1 somewhere in the chain), I heard a rumor that SHA1 support for the Root CA may come back in 6.14.1 or 6.14.2. I think there are even AP7xx that point back to an SHA1 root; when I checked in lab with AP745 there was no issue.

    If you are in this situation, it may be good to work with your local SE to see if it's worth to postpone your upgrade to 6.14 a bit till 6.14.1 or 6.14.2.



    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your HPE Aruba Networking partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact HPE Aruba Networking TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or HPE Aruba Networking.

    In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
    ------------------------------

    Original Message


  • 7.  RE: ClearPass Policy Manager 6.14 Release Announcement(s)

    Posted 16 days ago

    Hello All,

     

    We are pleased to announce the immediate availability of ClearPass Policy Manager 6.14.1!  This release is focused on security fixes and bug fixes.  This release also includes the adjustment in behavior around SHA1 certificates.

     

    Retroactive – 6.14.0 support for HPE Morpheus Software

    Why is this interesting? ClearPass 6.14.0 has completed validation to operate on HPE Morpheus Software (also known as HPE Morpheus VM essentials) as a fully supported hypervisor.  The 6.14 Installation Guide will be updated to indicate the steps to configure this hypervisor

     

    Support RADIUS and RadSec SHA-1 Root Certificates

    Why is this interesting? ClearPass 6.14.0 removed support for SHA-1 certificates.  Many devices with non-public CA signed certificates support SHA-2 certificates but may continue to be ultimately anchored to SHA-1 certificates.  This change allows for SHA-1 root CAs to be used as long as the certificate chain is otherwise using SHA-2 certificates and the proposed ciphers are using SHA-2.

     

    As always, please take note of the 'Changes of Behaviors' section of the release notes https://arubanetworking.hpe.com/techdocs/ArubaDocPortal/content/new-portal/clearpass.html#

    The update images have been posted Networking Support Portal (NSP)  and the software updates portal.

    NOTE: Due to an internal error the 6.14 Installation Guide updates will be delayed until the end of this week.

    A big thanks and congratulations to the ClearPass Engineering, ClearPass QA and TechPubs teams for reaching this milestone!

    Best regards,

    The HPE Networking ClearPass Team




  • 8.  RE: ClearPass Policy Manager 6.14 Release Announcement(s)

    Posted 2 days ago

    Hello all,

    The RelNotes for 6.14.1 describe about old SHA1 certificates permitted for AP 802.1x Uplink

    back to the SHA1 "Aruba Networks Trusted Computing Root CA 1.0" certificate topic how to migrate from 6.12.8 to 6.14.1 without losing 802.1x AP Uplink

    To be allowed to upgrade to 6.14.0 at first the above certificate must be disabled and then will be removed after the upgrade breaking AP uplink NAC.

    Then  we can  apply 6.14.1 update (that will support back the old Root certificate) but during all of those steps AP NAC will be OOS 😕

    Then, maybe, we can import again the certificate "Aruba Networks Trusted Computing Root CA 1.0"

    Is there any other supported procedures to make the move from 6.12 to 6.14 more smooth related to this topic ?

    Kind regards
    Christian Chautems


    Original Message


Related Content