Jump to content

connection between ERA server and agents fail


Recommended Posts

Hi, I have serious problem that the ERA server (centos7) can not see any of agents.

I attached the trace.log file of one of my agents which is a Win server 2012.

It shows that :

2020-09-01 12:01:25 Error: NetworkModule [Thread 984]: Verify user failed for all computers: 10.10.101.222: NodVerifyCertificateChain failed: NodVerifyTrustResult: 42, NVT_NotTrusted, X509ChainStatus: 0x10000, X509CSF_PartialChain
2020-09-01 12:01:25 Error: NetworkModule [Thread 984]: Receive: NodSslWriteEncryptedData: Incorrect/unknown certificate or key format., ResolvedIpAddress:10.10.101.222, ResolvedHostname:, ResolvedPort:2222
2020-09-01 12:01:25 Error: NetworkModule [Thread 984]: Protocol failure for session id 319649, error:Receive: NodSslWriteEncryptedData: Incorrect/unknown certificate or key format.
2020-09-01 12:01:25 Error: CReplicationModule [Thread 13fc]: CReplicationManager: Replication (network) connection to 'host: "eset.lavego.de" port: 2222' failed with: Receive: NodSslWriteEncryptedData: Incorrect/unknown certificate or key format.

I think this problem is because of my last try to deploy a new CA for my server, but I think I made a mistake.

Please help me to solve the issue... thanks

Screenshot 2020-09-01 at 14.15.05.png

trace.log

Link to post
Share on other sites
  • Administrators

The CA certificate is not trusted. Try creating a new live agent installer via ESMC and run it on the troublesome client so that the CA and agent peer certificates are updated.

Link to post
Share on other sites

Please help me how to create Live agent installer and is it possible to deploy it to client from Era server? because there are 91 clients and some of them are Linux and the others are Windows.

 

Link to post
Share on other sites
  • ESET Staff

Error means that there is no CA certificate suitable for verification of ESMC Server certificate (as currently used for connection AGENTs) - do you use some custom certificate or were there any changes in ESMC configuration?

Link to post
Share on other sites

Yes before doing this mess-up. I try to change my server CA using our custom certificate. and after uploading that in ERA web server this problems begins.

Please help me to solve this situation. I'm really in bad situation.

Link to post
Share on other sites
  • Administrators

I'm afraid that we won't be able to help here any further and a ticket with your local support will need to be created. Note that this forum is not meant to be a substitute to contacting your local customer care but rather for sharing knowledge with moderators and advanced users. Even though an ESMC developer chimed in, the root cause was not obvious and more iterations and possibly logs too will be needed for further analysis. As for the response time, complaining after 2 hours of not receiving a response is not appropriate. Such short response time is provided by customer care and is guaranteed by SLA only for customers who pay for premium support.

Link to post
Share on other sites
  • ESET Staff
5 hours ago, Qmars said:

Yes before doing this mess-up. I try to change my server CA using our custom certificate. and after uploading that in ERA web server this problems begins.

Please help me to solve this situation. I'm really in bad situation.

So now I realized that two different issues are mentioned in this topic and I do reply to the one which is less critical (creation of installer).

Errors from AGENT's status logs is clear - it is not able to verify ESMC Server's certificate, because AGENT is missing CA certificate hat was used to sign this new certificate.

In case you have not removed original CA certificate from ESMC, solution might be to either create new ESMC certificate signed with CA certificate that is present in ESMC, or return back to use original ESMC certificate, which should be trusted by AGENTs. Just be aware that this might not be true if also other changes in certificates were made - your environment might be even in a state where it won't be possible to restore AGENTs connectivity and manual repair of clients will be required.

Link to post
Share on other sites
  • ESET Staff

Yes, I think it will work, as CA certificate for this SERVER certificate is present and thus available on client devices. Also this certificate is signed for host "*", so without any restrictions.

In case there was no other reason why you chose to change it, reverting back to this one should resolve issues.

Link to post
Share on other sites
  • ESET Staff
26 minutes ago, Qmars said:

Would you please tell me how reverting back and resolve the issue? Pleaseeeeeee

 

Changing certificate to original in ESMC' settings should be enough:
image.png

When you click "Open certificate list", you should be able to select original certificate, the one as shown in your previous screenshots. Just be aware that change will require restart of ESMC service.

Link to post
Share on other sites

Hi Martink, it works... I just want to thank you for your help... you help me alot... 

Is it ok to work with this Server certificate our I have to create another Agent certificate and change it?

Now I have two tasks:

1. Update the ESMC to 7.2 and my current version is ESET Security Management Center (Server), Version 7.1 (7.1.503.0)
ESET Security Management Center (Web Console), Version 7.1 (7.1.393.0)

2. Add our company certificate for the Https web browser

Would you please help me with these two tasks.

My current server is:

CentOS (64-bit), Version 7.7.1908  

Thank you again and looking forward to hearing from you.

Screenshot 2020-09-02 at 20.27.27.png

Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...