The customer migrated to a new SMP Server. He kept the same server name and IP address.
After he was done with the migration process, the client machines were able to communicate just fine to the SMP Server while in the internal network or VPN. However, when trying to connect in CEM mode, the following errors happened and no connection via CEM was established:
Operation 'CEM: Connect' failed.
Protocol: HTTPS
Original host: <SMPserver>.<yourdomain>.net:443
Real host: <externalgatewayname>.<yourdomain>.com:443
Path: /
Connection id: 429.4576
Communication profile id: {xxxxxxxx-7A71-4222-98D8-6F97D5B9B96B}
Throttling: 0 0 0
Error type: Connection error
Error code: A socket operation was attempted to an unreachable host (10065)
Error note: Unable to connect via secure gateway
Gateway HTTPS connection info:
Server certificate:
Serial number: xx xx xx xx 54 56 d7 3b 34 46 5b d2 ac 58 bc f6 74 c5 51
Thumbprint: xx xx xx xx 19 78 dc 81 e1 5c ba 2a 72 c4 31 7b 6d 09 08 8d
Cryptographic protocol: TLS 1.2
Cipher suite: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
Cipher algorithm: AES
Cipher key length: 256
Hash algorithm:
Hash length: 0
Key exchange algorithm: ECDH
Key length: 255
-----------------------------------------------------------------------------------------------------
Date: 10/17/2023 12:01:15 AM, Tick Count: 64754234 (17:59:14.2340000), Size: 1.09 KB
Process: AeXNSAgent.exe (4576), Thread ID: 21372, Module: AeXNetComms.dll
Priority: 1, Source: NetworkOperation
The certificate chain was issued by an authority that is not trusted
-----------------------------------------------------------------------------------------------------
Date: 10/17/2023 12:01:20 AM, Tick Count: 64758281 (17:59:18.2810000), Size: 302 B
Process: AeXNSAgent.exe (4576), Thread ID: 18972, Module: InventoryRuleAgent.dll
Priority: 1, Source: HttpClient
getNewRulesFromWeb() error - The certificate chain was issued by an authority that is not trusted
-----------------------------------------------------------------------------------------------------
Date: 10/17/2023 12:01:20 AM, Tick Count: 64758296 (17:59:18.2960000), Size: 339 B
Process: AeXNSAgent.exe (4576), Thread ID: 18972, Module: InventoryRuleAgent.dll
Priority: 1, Source: InventoryRuleCache
While looking at the agent logs with verbosity logging turned on, we could see that the gateway was reachable:
Operation 'CEM: Connect' completed successfully.
Protocol: HTTPS
Original host: <SMPserver>.<yourdomain>.net:443
Real host: <externalgatewayname>.<yourdomain>.com:443
Path: /
Connection id: 430.4576
Communication profile id: {xxxxxxxx-7A71-4222-98D8-6F97D5B9B96B}
Throttling: 0 0 0
Gateway HTTPS connection info:
Server certificate:
Serial number: xx xx xx xx 43 54 56 d7 3b 34 46 5b d2 ac 58 bc f6 74 c5 51
Thumbprint: xx xx xx xx 19 78 dc 81 e1 5c ba 2a 72 c4 31 7b 6d 09 08 8d
Cryptographic protocol: TLS 1.2
Cipher suite: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
Cipher algorithm: AES
Cipher key length: 256
Hash algorithm:
Hash length: 0
Key exchange algorithm: ECDH
Key length: 255
-----------------------------------------------------------------------------------------------------
Date: 10/17/2023 12:01:19 AM, Tick Count: 64758046 (17:59:18.0460000), Size: 972 B
Process: AeXNSAgent.exe (4576), Thread ID: 18972, Module: AeXNetComms.dll
Priority: 8, Source: NetworkOperation
ITMS 8.x
The Server CA and Agent certificates from the original SMP Server were not migrated properly.
In this particular instance, for the Symantec Management Agent and Gateway to be able to validate the certificates in use, it is necessary to use the same root certificates (which for ITMS are the Server Ca and Agent CA certificates).
The following needs to be done in order to ensure the proper Server CA and Agent CA certificates are placed on the new SMP server for proper communication:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Altiris\eXpress\Notification Server\CA\Agent]
"Thumbprint"="E4C91063xxxxxxxxxxxxxxxxxxxxxxxAC2"