Software will not download when clients are connected to CEM

[HHenry]

We have Altiris 8.5 and recently we noticed that our Windows 10 clients that are connected to the Internet only, are not getting software installs. The client is able to check into Altiris but not receive software installs. The download never starts and the folder in SDAPPS is never created. This occurs for any software. But if the client connects to the Corporate network in the office or to our Corporate VPN then it will be able to download and install software successfully. Both of our CEM servers are online, we restarted the services on our Notification server, and the Site Servers seem to be intact. Not sure why software downloads are halted while connecting to CEM only.

[Sergei Zjaikin]

Hi, what do the agent logs say? There should be some errors or warnings, something like this for example:

Operation 'CEM: Get' failed.
Protocol: HTTPS
Host: server.company.aa:443
Path: /altiris/NS/Agent/GetPackageInfo.aspx
Connection Id: 77.4344
Communication profile Id: {0AB0F532-6F33-4192-9437-C3884EE52895}
Throttling: 0 0 0 
Error type: Socket error
Error code: An operation was attempted on something that is not a socket (10038)
Error note: SocketHandle::Close error
Gateway HTTPS connection info:
   Server certificate:
      Serial number: 6c e4 ab 68 8b d4 d2 09 02 eb 1d 92 78 8a 98 44 6c 51 9c 1c
      Thumbprint: 15 79 0f 22 b7 b6 84 78 3f 28 3d c7 77 08 79 ea 70 79 36 4e
   Cryptographic protocol: TLS 1.2
   Cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256
   Cipher algorithm: AES
   Cipher key length: 256
   Hash algorithm: SHA384
   Hash length: 384
   Key exchange algorithm: ECDH_P256
   Key length: 256

[HHenry]

[HHenry]

[Sergei Zjaikin]

There is a red log entry at the bottom of screenshot starting with words:

Operation 'CEM Connect' failed...

I need the whole text, it is much longer and contains the reason of connection failure.
Could you please open the log file in notepad, find this or similar error and send it?
I don't need the host names, but the rest is important.

thanks!
sergei

[Pablo Llorente]

Hello,

We faced the same issue and finally we confirmed that our certificate was expired. When the computer is in cloud mode, the packages are published logically in https, so the certificate enter into the game. 

Check the gateway (where you can see the certificate) and check if it has been expired or removed, go to CEM and with the setup you can check if you configured the right certificate, and you can replace it with the new one generated.

Hope it helps.

Saludos, Best Regards

_____________________________________________________________

Pablo Llorente Abad

Workplace Specialist - EMEA IT Services

Workplace Services

LafargeHolcim IT EMEA

Albasanz 14 28037 Madrid, Spain

Phone (Mobile): [phone]

Phone (Desktop): [phone]

[e-mail]

More information at www.itemea.lafargeholcim.com

Follow us on Facebook | Twitter | LinkedIn

To visit our Workplace Connect site click here 

[HHenry]

[Sergei Zjaikin]

This screen shot actually contains the possible failure reason - the machine has at least one NOT self signed certificate in Trusted root store.
There is a bug in some versions of IIS on some versions of Windows, where the presence of NOT self-signed certificate in Trusted Root store breaks certificate validation during HTTPS connection establishment.
You need to open Certificate Manager on NS server and check Trusted Root store, identify all NOT self-signed certificates and find out where they came from and what to do with them - they should not be there. It could be that some software adder them in that store or someone added them manually.

regards,
sergei

[Igor Perevozchikov]

Certificate status can be checked from SMP Console
Settings -> All Settings -> find there "Certificate Management" page
On Site Server Management page, check Package Server status which serves CEM clients (Also check Outbound transfer policy settings for Internet Sites)

------------------------------
Software QA Engineer 3
Broadcom Inc.
------------------------------

[HHenry]

I appreciate everyone's responses. We found out that the issue was related to our corporate network and firewall settings. CEM and application downloads are now working as they should.