After uploading a new certificate to OAG and associating it with a particular application, the client browser is still seeing the old certificate when accessing the application.

• Okta Access Gateway (OAG)

Possible causes include the new certificate having an issue that is preventing NGINX from properly reloading, the HA issue preventing the admin node from pushing the new certificate to the worker nodes, or TLS termination being implemented at the front-end load balancer such that OAG is not responsible for presenting the certificate to the client.

 

1. If the new certificate was never able to properly upload via Management Console, verify that it is in PEM format and not password protected by following this KB article:
2. If the certificate appeared to successfully upload:
   • Check the status of the NGINX service to see if it properly reloaded after trying to associate the new certificate.
   • Check the HA status to ensure that the admin node is able to successfully push the new certificate to the worker nodes. 
   • Suggest monitoring the OAG logs for any further clues.
3. If there are no issues observed from the OAG perspective (certificate was successfully uploaded and associated to the application without any error, NGINX service and HA are in good status, no errors logged on OAG) but still the client is seeing the old certificate, it is likely that the network topology involves TLS termination at the front-end load balancer. In this configuration, the load balancer is responsible for presenting the certificate to the client and, therefore, suggests working with the load balancer team to update the certificate on the LB side.
   • One way to verify this would be to use the workstation's host file to create an entry that points the application URL directly to OAG(Refer to documentation). This way, the load balancer can be bypassed, and the certificate that OAG is presenting can be directly seen. If the updated certificate can be seen in this manner, this confirms that OAG has properly updated the certificate, but the load balancer is still presenting the old certificate.
   • For more details on TLS termination and its role in certificate management, please see:

• Manage SSL/TLS termination
• Access Gateway certificate use