Incorrect license expiration date in Kaspersky Security Center
Show applications and versions that this article concerns
- Kaspersky Security Center 14.2 (version 14.2.0.26967)
- Kaspersky Security Center 14 (version 14.0.0.10902)
- Kaspersky Security Center 13.2 (version 13.2.0.1511)
Issue
After adding a license to Kaspersky Security Center using an activation code, the license expiration date and the license activation date change to 1970. Therefore, the license cannot be activated on managed devices. The Add key task takes a long time to process and fails with the error message: “Failed to convert the server address. Please check Internet connection settings.”
Cause
You may encounter the issue when connecting to the Kaspersky activation server. When you activate the application using an activation code, access to the activation servers is required to re-verify the license.
Solution
Follow the recommendations depending on your situation:
- The Administration Server is used to distribute licenses to devices.
- The network is isolated from the Internet or the previous recommendations didn’t help.
- The activation problem only occurs on certain devices.
If you use the Administration Server to distribute the license to devices
- Make sure that the network settings for connecting Administration Servers to external services are correct. You can check this in the logs of the proxy server or network equipment that provides access to the Internet.
- Check if using of unencrypted network traffic is allowed on SSL ports.
- Make sure that Encrypted connection scanning between the Administration Server and the proxy server is disabled if your infrastructure uses Deep Packet Inspection (DPI) or traffic decryption and analysis technologies (SSL inspection) as part of third-party security solutions.
If the scanning of encrypted connections is enabled, the update download fails with the error “Failed to establish the HTTPS connection: TLS error (54). ‘/’”. To fix this issue, replace HTTPS with HTTP to avoid the issues with the proxy server. - If the Administration Server downloads updates through the proxy server, check whether the credentials for the proxy server are correct.
To check this, log in to the proxy server using these credentials to check this. - Check that there are no network connection errors when trying to re-add an activation code to the Administration Server repository using these instructions.
- Use these instructions to check if Kaspersky Security Center is used as a proxy server to activate applications on managed devices.
- Use these instructions to check if network ports for application activation, configured in the Administration Server properties, are accessible on managed devices.
- Make sure that the version of Kaspersky Security Center and protection applications for endpoint devices are supported. We recommend upgrading the applications to the latest version.
- Make sure the Network Agent version on managed devices matches the Administration Server version.
If all the recommendations are implemented, the activation will be successfully completed after the next synchronization with the Administration Server, and the date will be corrected. The default synchronization period of the Network Agent is 15 minutes, but we recommend to wait for 30 minutes and check if the issue is solved on all the active devices. For more information about the synchronization settings, see this article.
If the network is isolated from the Internet
- Delete the license of a managed application from the Administration Server storage.
- Open Kaspersky Security Center and open Kaspersky Licenses.
- Right-click the required license and select Delete.
- Click Yes in the confirmation window.
- Generate a key file using an activation code. For details, see these instructions.
- Add the key file to the Administration Server repository using these instructions.
If the activation problem occurs on certain devices
- Check if the date and time on the managed devices are correct using these instructions.
- Make sure that the Network Agent is correctly connected to the Administration Server.
- Restart the affected operating system and check if the problem persists. If you are unable to restart the device, relaunch the application using these instructions and restart the Network Agent service.
- Reinstall the Kaspersky application on the managed device.
The incorrect date on the device may have broken the licensing mechanism when the application was installed. This mechanism may also have been damaged later for other reasons.
How to check if network ports used for activation are accessible
- Open KSC, select Administration Server node and click Server properties.
- Go to Administration Server connection settings → Additional ports.
- Check what port is specified in the SSL port for the activation proxy server field.
- Check what port is specified in the Port for mobile device activation field.
- Check connection to the ports described in the previous step using the following command:
ksc.example.com is a Fully Qualified Domain Name (FQDN) of the Administration Server 17000 is a port for activating the application on managed devices
- Examine the command execution result and follow the guides described in the “Solution” column in the table below.
| Error / Result | Cause | Solution |
|---|---|---|
The error “Name resolution of ˂ksc_name˃ failed” occurs; the string “RemoteAddress” is empty. | The FQDN name could not be converted to an IP address. | Try using an IP address to connect to the KSC Administration Server.
To be able to connect via the FQDN name, fix DNS name resolution issues. |
| “TCP connect to (˂ksc_ip˃ : ˂activation_port˃) failed.” | The issue is related to network availability. | Check the traffic filtering settings in network equipment, operating system firewall, and protection solutions for the end nodes. Make sure that allow rules are enabled to establish connection. |
“Ping to ˂ksc_ip˃ failed with status: Timeout” | No response to an Echo Request from the Administration Server. In some cases, such a behavior is normal and does not indicate network availability problems with the Administration Server. If so, when outputting the command, there will be the “PingSucceeded:True” string which confirms the Echo Response. | If it’s not possible to temporarily enable ICMP protocol for diagnostics via Echo Requests:
|
| The string “TcpTestSucceeded: True” appears. | The MMC port is accessible from the administrator’s workstation. | Check the connection again via the remote Administration Console. |
How to check if Kaspersky Security Center is used as a proxy server to activate applications on managed devices
- Open Kaspersky Security Center and go to Policies.
- Right-click a policy of the required application, e.g. Kaspersky Endpoint Security for Windows, and click Properties.
- Select General settings → Application settings.
- Make sure that the padlock is set in the Operating mode block, and the Use Kaspersky Security Center as proxy server for activation check box is selected.
The set of available policy settings varies depending on the managed application. The Use Kaspersky Security Center as proxy server for activation option is available for all applications but may be located in another group of settings.
What to do if the issue persists
If the issue persists, submit a request to Kaspersky technical support via Kaspersky CompanyAccount. In your request:
- Describe the issue:
- Attach a screenshot of the activation error.
- List all diagnostic steps you followed.
- Attach screenshots of the console output after running the diagnostic commands specified in this article.
- On a device with the activation error, collect synchronous traces of level 4 of the Administration Server and the Network Agent. To do this, see these instructions. The tracing duration should last longer than the synchronization duration of the Network Agent with the Administration Server. If the default synchronization period of 15 minutes is set, the tracing should last 30 minutes. Attach the trace files to your request.
- Generate a Get System Info report, which includes Windows Event Log, from the Administration Server and from the device with the activation error using these instructions. Attach the generated report to your request.
