When you do an upgrade on SAL 2.5 to SP2, if the certificate name is entered differently than what's in the GWUI (uppercase letters instead of lowercase, for example), it will need to be changed ahead of time otherwise you will be locked out.
If the upgrade is completed but it is discovered that Avaya and/ or the BP are locked out, immediately look in the xGate.log for a certificate error (referring to the CN being different than what is on the server). Example;
[ 0, 9, 7, 227] 11-10-2015 09:23:54.936 ERROR-- xgEnterpriseProxy: Web Client (https://SAL_BP_NAME.BP_SITE.com/eMessage): SSL: server's certificate verification failed (error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed)”
note: before you apply service pack please install 2.5 installer then apply the service pack