"Failed to validate server certificate" when adding a site server to Internet Gateway

Products

• Client Management Suite
• IT Management Suite
• Server Management Suite
• Asset Management Suite

Issue/Introduction

The following error is returned when adding a Site Server to the Internet Gateway (under the "Servers" tab):

Failed to validate server certificate

 

Environment

ITMS 8.7.x, 8.8.x

Cause

Misconfiguration in the Site Server's IIS binding (specifically port 4726), port 4726 is not open in the Site Server's firewall, or a mismatch in the assigned SMP Server CA certificate.

Resolution

Here are some suggestions on what to check: 

1. Verify Connectivity: By default, the Internet Gateway and the Site Servers communicate with each other using port 4726.  Port 4726 needs to be bound in IIS using the https protocol and the correct certificate assigned. Use Test-NetConnection -ComputerName [SiteServerIP] -Port 4726 from the Internet Gateway server to ensure the port is open and reachable. 

   The results will be something like:

   ComputerName     : ServerName
   RemoteAddress    : 1.1.1.1
   RemotePort       : 4726
   InterfaceAlias   : Ethernet0
   SourceAddress    : 1.1.1.2
   TcpTestSucceeded : True
   
   NOTE: If port 4726 is opened, it should return TcpTestSucceeded : True
   

2. Check IIS Bindings: On the Site Server, verify in IIS Manager that port 4726 is correctly bound with the appropriate Site Server HTTPS certificate.
3. Validate Certificates: Ensure the Site Server certificate has the expected SMP Agent CA (or internal CA and Intermediate certificate) under the "Certification Path" tab.
4. Review SMP Settings: In the SMP Console, navigate to the Settings > Notification Server > Site Server Settings page and confirm the correct SMP Server CA is assigned under "Web Configuration" for the desired Site Server.

Additional Information

Ports and Protocols for Symantec IT Management Suite (ITMS) 8.x