Unable to Generate Cloud-enabled Agent Installation Package – “No Registered Master Certificate” Error

Products

• IT Management Suite

Issue/Introduction

When attempting to generate or download a Cloud-enabled Management (CEM) agent installation package in IT Management Suite (ITMS) 8.8.1, the operation fails with the following error:

Failed to generate package. Cannot issue certificates at this time because there is no registered master certificate with the specified name.

This error occurs on the SMP (Symantec Management Platform) Server under Settings > Notification Server > Cloud-enabled management > Setup > Cloud-enabled Management Setup > Symantec Management Agent Configuration tab.

Additionally, attempts to back up CA certificates (using Symantec Installation Manager > Repair installed products > Back up or restore Notification Server configuration) may also fail with errors:

Failed to backup CA configuration. Failed to load CA certificates.

Environment

IT Management Suite (ITMS) 8.7.x,  8.8.x

Symantec Management Platform (SMP)

Cloud-enabled Management (CEM)

Cause

The error indicates a mismatch or broken reference to the Agent CA (Master Certificate) that signs CEM installation packages. This commonly occurs after migrating to a new SMP server or generating new Server CA and Agent CA certificates. Even if correct thumbprints are added to the registry, the internal certificate references within the SMP Console may still point to the legacy or incorrect certificate.

Although certificates and thumbprints may appear correctly configured, internal references used during certificate issuance (especially for Agent CA signing operations) are not properly aligned.

As a result:

• The system cannot locate the correct Master Certificate
• Certificate issuance fails
• CEM package generation fails

Resolution

To resolve this issue, use the Replace process in the Certificate Management page to overwrite the invalid certificate references. 

Step 1: Validate Certificate Issues

1. Attempt to generate a CEM package
2. Attempt to backup CA configuration via SIM

If both fail → confirms certificate reference issue

Step 2: Review Logs

Check Notification Server logs:

C:\ProgramData\Symantec\SMP\Logs\

 

Look for entries similar to:

Cannot issue certificates at this time because there is no registered master certificate with the specified name.

 

Step 3: Use Certificate Replace Process

Follow the process from:

Steps to replace, renew, and revoke certificates in ITMS 8.x

Steps:

1. Open SMP Console
2. Navigate to:
   • Settings > All Settings > Notification Server > Certificate Management.
3. Locate the Agent CA Certificate (usually displayed as NS root certificate)
4. Use the Replace option
   
5. Re-import or reselect the correct certificate
6. Complete the wizard ensuring:
   • Correct certificate chain
   • Proper Master Certificate linkage
     
     Note: This process propagates the new certificate references across the Notification Server without breaking existing connectivity.
7. Monitor the distribution progress on the Certificate Management page.
8. Once distribution is finished, select the certificate again and click Finalize on the toolbar

Step 4: Retry Package Creation

1. Navigate to:
   • Settings > Notification Server > Cloud-enabled management > Setup > Cloud-enabled Management Setup > Symantec Management Agent Configuration tab.
2. Generate a new CEM Agent Installation Package

Additional Information

 

Error: "Failed to generate package" when generating CEM agent packages

Error: "Cannot issue certificate...there is no registered master certificate with the specified name" when generating CEM agent packages

Steps to replace, renew, and revoke certificates in ITMS 8.x