You must specify the certificate for winrm because it does not use the correct one when using the quickconfig option.
Symptoms
In the collector log there are messages about "untrusted server certificate chain"
There are 3 areas where the certificate must match
- The winrm configuration thumbprint
- The winrm listener thumbprint
- The Symantec Agent must have the certificate imported into it using keytool.exe
If a certificate either has not been setup, or winrm is setup with the wrong certificate file, or the certificate has not yet been installed into the Symantec Agent, the connection will fail with this error.
You can manually set which certificate winrm uses by specifying the Certificate Thumbprint when you create the listener.
To create a new listener that specifies the Certificate Thumbprint:
Set the winrm configuration to use the correct thumbprint by entering the following command:
winrm set winrm/config/service @{CertificateThumbprint="<Hexidecimal thumbprint value from the correct certificate>"}
NOTE: You may need to remove the spaces from the thumbprint string
keytool -importcert -trustcacerts -alias Symc-CA -file Symc-CA.cer -keystore "C:\Program Files\Symantec\Event Agent\jre\lib\security\cacerts" -storepass changeit
Symc-CA is an alias for the domain root certificate.
Symc-CA.cer is a file with the domain root certificate.
Default Paths to the java certificate keystore.
32bit Windows:
C:\Program Files\Symantec\Event Agent\jre\lib\security\cacerts
64bit Windows:
C:\Program Files (x86)\Symantec\Event Agent\jre\lib\security\cacerts
The default password for the certificate keystore is changeit.