Certificate issues preventing login, Test enviornment

Kinetic ERP
, ,
1

So I had 2024.2 up and running on my 10.2.700 live server as a testing environment to get users exposed to Kinetic before we move, however I tried accessing the “browser” version of Kinetic and I got an SSL certificate error in the browser so I followed some instructions online that gave me directions on how to create a new self signed cert within PowerShell, and then was told to bind that to my IIS server settings. I did all of that and voila the browser environment began working. Unfortunately that immediately broke my client login abilities as well as my ability to login to the Admin Console for that Application Server…

I’ve reversed everything I’ve done as well as removed the certificate from the server that I created yesterday and I’m still getting this error from a client machine. I can login fine on the server through the locally installed client so I know the app server is working.

I can see by the error that it’s related to the SSL Certificate and trust relationship, but for the life of me I can figure out what changed that I have not already undone. I’ve also rebuilt the site in app config, and redeployed the app server.

System Information

==================

AppServer Connection: https://----------------/EpicorERP-Live
Form Name: ShellMenuForm
Customization Name:
Menu ID:
Software Version: 4.3.200.0

============

Application Error

Exception caught in: mscorlib

Error Detail

============
##!Message:##! An error occurred while sending the request.
##!Inner Exception Message:##! The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel.
##!Program:##! CommonLanguageRuntimeLibrary
##!Method:##! ThrowForNonSuccess

Client Stack Trace

==================
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Extensions.Http.Logging.LoggingHttpMessageHandler.<g__Core|5_0>d.MoveNext()
— End of stack trace from previous location where exception was thrown —
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Extensions.Http.Logging.LoggingScopeHttpMessageHandler.<g__Core|5_0>d.MoveNext()
— End of stack trace from previous location where exception was thrown —
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Epicor.ServiceModel.Channels.ImplBase.d__126.MoveNext()
— End of stack trace from previous location where exception was thrown —
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Epicor.Utilities.AsyncHelper.RunSync[TResult](Func1 method) at Epicor.ServiceModel.Channels.ImplBase.Execute(String methodName, RestValueSerializerBase serializer, ProxyValuesIn valuesIn, ProxyValuesOut valuesOut) at Epicor.ServiceModel.Channels.ImplBase.<>c__DisplayClass122_0.<CallWithCommunicationFailureRetry>b__0(Context _) at Polly.Policy1.<>c__DisplayClass13_0.b__0(Context ctx, CancellationToken _)
at Polly.Retry.RetryEngine.Implementation[TResult](Func3 action, Context context, CancellationToken cancellationToken, ExceptionPredicates shouldRetryExceptionPredicates, ResultPredicates1 shouldRetryResultPredicates, Action4 onRetry, Int32 permittedRetryCount, IEnumerable1 sleepDurationsEnumerable, Func4 sleepDurationProvider) at Polly.Retry.RetryPolicy1.Implementation(Func3 action, Context context, CancellationToken cancellationToken) at Polly.Policy1.Execute(Func3 action, Context context, CancellationToken cancellationToken) at Polly.Policy1.Execute(Func`2 action, Context context)
at Epicor.ServiceModel.Channels.ImplBase.CallWithCommunicationFailureRetry(String methodName, ProxyValuesIn valuesIn, ProxyValuesOut valuesOut, RestRpcValueSerializer serializer)
at Epicor.ServiceModel.Channels.ImplBase.CallWithMultistepBpmHandling(String methodName, ProxyValuesIn valuesIn, ProxyValuesOut valuesOut, Boolean useSparseCopy)
at Epicor.ServiceModel.Channels.ImplBase.Call(String methodName, ProxyValuesIn valuesIn, ProxyValuesOut valuesOut, Boolean useSparseCopy)
at Ice.Proxy.Lib.SessionModImpl.Login()
at Ice.Core.Session.GetSessionId(String asUrl, String companyId, String plantId)
at Ice.Core.Session.InitSessionMod(String asUrl, Boolean fwVerCheck, String companyID, String plantID, String sessionId)
at Ice.Core.Session.InitSession(Action setCredentials, String asUrl, Guid licenseTypeId, String pathToConfigurationFile, Boolean fwVerCheck, String companyID, String plantID, Boolean useChannelCacheForServices, String sessionId)
at Ice.Core.Session..ctor(String userID, String password, String asUrl, Guid licenseTypeId, String pathToConfigurationFile, Boolean fwVerCheck, String companyID, String plantID, Boolean useChannelCacheForServices, String sessionId, String edgeAgentToken)
at Ice.Core.Session..ctor(String userID, String password, Guid licenseType)
at Ice.Lib.LogOn.CreateSession(String userID, String password, String appServerUri, Guid licenseType, SessionTokenType sessionTokenType, Object azureADOwnerWindow)
at IceShell.Apps.LogonDialog.logOn(String userID, String password, Boolean promptUpdatePassword)
at IceShell.Apps.LogonDialog.DoWorkLogon()

Inner Exception

===============
The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel.

at System.Net.HttpWebRequest.EndGetRequestStream(IAsyncResult asyncResult, TransportContext& context)
at System.Net.Http.HttpClientHandler.GetRequestStreamCallback(IAsyncResult ar)

Inner Exception

===============
The remote certificate is invalid according to the validation procedure.

at System.Net.TlsStream.EndWrite(IAsyncResult asyncResult)
at System.Net.PooledStream.EndWrite(IAsyncResult asyncResult)
at System.Net.ConnectStream.WriteHeadersCallback(IAsyncResult ar)

2

Ok, so I just installed the server Cert on the local machine and now it is working as expected. I swear I did not have that certificate installed on the machine prior to attempting to get the browser version working, and the client had been working from the start, I don’t know why it was working before messing with that binding setup. I would have thought reversing what I attempted wouldn’t have changed a requirement to need a cert on the client.

I hate certificates.

3

You need a public cert. Self signed always has to be installed on the individual machine. It will be a pain forever if you don’t get public.

1 Like
4

Our full environment is private, nothing is public facing so self signed should be sufficient for our scenario. It was just that I did not have the certificate installed on the client machine. I went back to check my GPO settings and I had it setup to distribute the Server cert already so my thought of it not being there originally was probably incorrect.
I most likely removed both when I was getting rid of the PowerShell created one for testing the browser environment. It ended up being a different config change that caused my Admin Console connection issues so it was my own actions that broke the client connection on my desktop.

5

Reinstalled the cert I created with PowerShell, bound that to the IIS server and distributed that to my desktop and now both the client application and the browser is working. So I can confirm I created this mess myself. lol

1 Like