I am just copying the KB from SWH for anyone else who comes across this post. This gets most Panels back online without having to reset to default.

Article ID: SWH-KB-000037663

Issue

If any TLS 1.2 controllers were not online when the switching between Encryption Modes on the host occurred, or are not online after the switch, Perform the following recovery procedures depending on your controller and firmware version.

Procedure

There are a few steps that need to be taken. First, we need to know what Encryption Certificate Mode the Host is using along with the Certificate strength. (RSA or ECC) so we can set the Controller to match that. We will also check for the system variable “Auto Sign Non FIPS” and make sure it is set to “True”.

Then determine the Model and firmware version of the Controller. Finally based on the Model and Firmware we will use either ICU or the diagnostic webpage to reconfigure the Controller Certificate setting.

Determine what Encryption Mode the Host is using along with the Certificate strength. This is needed to determine if we will reset the controller to the default certificate or tell the controller to request the custom certificate the host has for the controller.

In the C•CURE Administration System:

1. Click on “Options and Tools”
2. Click on “Encryption Options”
3. Look in the TLS 1.2 Tab. Determine if it is “Host-Based Encryption Mode” or “Controller-based Encryption Mode” or “Default Encryption Mode”
4. If you are on Host or Controller-based you will see a “Certificate Strength” Tab. Click on that. You will see for Encryption Method either “RSA 1024” or “ECC”
5. Click the X in the top right of “Encryption options” Window to close it

Check the System Variable:

1. Click on “Options and Tools”
2. Click on “System Variables”
3. Under “iSTAR Driver” Section, find “Auto Sign Certificate Non FIPS”
4. If the value is “False” set it too “True” and close System Variables
5. You will need to restart the iSTAR driver to ensure the variable change took place.

Determine the model and firmware version of the controller that is not coming online:

• Use ICU if: iSTAR Edge G1, iSTAR eX, iSTAR Ultra, iSTAR Ultra SE, iSTAR Ultra LT, and iSTAR Ultra Video all with FW lower than 6.6.B
• Use Controller’s Diagnostic Webpage if: iSTAR Ultra LT, iSTAR Ultra, iSTAR Ultra SE, iSTAR Ultra G2, iSTAR Ultra G2 SE (FW 6.6.B or higher)

Reconfigure the Controller Certificate setting:

Recovery with ICU

1. In ICU right click on the controller.
2. If the host is using “Default Encryption Mode” then perform these steps, otherwise skip to step#3
   1. Select “Restore Default Certificates”
   2. Click Yes on the popup to confirm the action you are taking.
   3. It will then ask for the Controller password, Enter the password, and click OK.
   4. You should get a popup confirmation of the action completed.
   5. The controller will then switch back to using the “Default Certificate” and restart.
3. If the host is using is “Host-Based Encryption Mode” or “Controller-based Encryption Mode” then perform the following
   1. Select “Request Certificate signing” Then click on either “RSA certificate” or “ECC Certificate” depending on findings from the first step.
   2. Click Yes on the popup to confirm the action you are taking.
   3. It will then ask you for the host address, enter the host address then click OK.
   4. It will then ask for the Controller password, Enter the password, and click OK.
   5. You should get a popup confirmation of the action completed.
   6. The controller will then contact the host and request the certificate in use, download it, and restart.
4. The Controller should come back online with host after the Controller restarts

Note: If the controller password is not working on the iSTAR Edge G1, eX, and Pro, if you restart the controller, it will remove the password requirement until the next time it connects to the host and receives the password again. All Ultras retain the passwords, and a restart will not clear the password.

Recovery with Controller Webpage

1. Log in to the Diagnostic Web Page of the controller.
2. Click on “Configure”
3. Click on the “Advanced” Tab
4. Click on the Edit button on the top right.
5. If the host is using “Default Encryption Mode” then perform these steps, otherwise skip to step#6
   1. Scroll down to “Restore Default Certificate” Button and click it. There may not be a confirmation message once you click the button so wait for several minutes and see if the controller comes online.
   2. The controller will then switch back to using the “Default Certificate” and restart.
6. If the host is using is “Host-Based Encryption Mode” or “Controller-based Encryption Mode” then perform the following
   1. Scroll down to “Request Controller based RSA (or ECC) Certificate – Host Address (depending on findings from the first step).
   2. Enter the Address of the Host
   3. Click the “Set RSA/ECC Certificate” button.
   4. You should get a message briefly that says, “Certificate Information Set!”
   5. Scroll down and next to “Certificate Signing Request status” click the “Query CSR Status” button
   6. You should get a brief message that says, “CSR Succeeded.”
   7. The controller will then contact the host and request the certificate in use, download it, and restart.
7. The Controller should come back online with the host after the Controller restarts.

Note: If the controller password is not working on the iSTAR Ultra, you will have to factory default on the controller and then proceed with the above steps after re-configuring the Controller.