EKW Scanners Inaccesible URL

[pphillips (Peter Phillips)]

Hi Mark,
On the new device, has Chrome been configured to ignore SSL errors?

[Mark_Wonsil]

I will check in the morning. Of course, getting a real cert would work too.

[pompe4040 (connor salmon)]

We have the same issue we are self signed but randomly turning the scanner off and on would fix it but other times it would not

[Mark_Wonsil]

I tested connecting to my dev box with a trusted cert from Let’s Encrypt and was able to connect to that app server without any problems. It seems that Google is getting more stringent with certificates, and it appears that it’s a trend that isn’t going to let up anytime soon.

The question now is how much time to we put into getting self-signed certs working vs. updating our infrastructure?

@pphillips, the BISCiT confluence site (Login-to-system-using-self-signed-certificate) suggests hitting the site using Chrome and accepting the certificate. The Advanced option is no longer an option when we tried that.

[eeaquino (Edgar Aquino)]

Same problem started happening to us too.

The issue is the SSL Certificate, the one that Epicor generates only sets the Key Usage for keyEncipherment, dataEncipherment. The recommendation is to regenerate the certificate using OpenSSL and select digitalSignature, keyCertSign, cRLSign. I would probably do all 5 just in case Epicor or Biscit validate. Not an expert in this, just following recommendations from others using self signed certificates after Chrome started doing some extra validations.

Or the other option is to get a CA signed certificate from LetsEncrypt, Sectigo, or some other and apply it to Epicor. That should also solve the problem.

For reference the Error is ERR_SSL_KEY_USAGE_INCOMPATIBLE.

[Chris (Chris Lorenz)]

In case it’s helpful, Clint’s post on another thread has instructions on how to generate a valid self-signed certificate via PowerShell, and if using that self-signed cert, you’d likely need to install that certificate on each device.

I used their instructions specifically because I ran into the “ERR_SSL_KEY_USAGE_INCOMPATIBLE.” error when accessing Epicor via the web UI and/or REST.

Cannot Access On-Premise Environments Through Browsers

As long as the self-signed cert is in trusted authority you can use fine in Edge or Chrome. PowerShell script to create and install self-signed cert. Just need to create proper binding in IIS after creation. param ( [Parameter()] [string]$certname=$($env:COMPUTERNAME), ## Identify the Host this cert is being generated for if not supplied. [Parameter()] [string]$dnsname=$($env:COMPUTERNAME+"."+$env:USERDNSDOMAIN ) , ## Build a fqdn we hope if one is not supplied. [Pa…

[Mark_Wonsil]

@Chris

and if using that self-signed cert, you’d likely need to install that certificate on each device.

And if using a trusted cert (like Let’s Encrypt), you don’t have to update each device.

[Chris (Chris Lorenz)]

@Mark_Wonsil

And if using a trusted cert (like Let’s Encrypt), you don’t have to update each device.

Yes, and that would definitely be the proper solution!

I had assumed a self-signed certificate been used, since it still has 8 years before expiring and it seems it’s already been in use for a while, but that’s a guess. If a certificate from a certificate authority had been used (and is now no longer functioning) then it should definitely be replaced with another certificate from a CA and not a self-issued certificate (though I’m surprised this issue would happen if the cert is from a CA).

[Narin_Yuth]

Out of curiosity, what MDM are you using?

[josecgomez]

Manage Engine

[klincecum (Kevin Lincecum)]

@Mark_Wonsil

Yes, we are using self-sign certs. Three

[Mark_Wonsil]

Who do you think is in charge over here?

[lsjlee (Alvin Lee)]

Dear All, I am having the same problem. Once I reset the scanner to factory default, EKW can be used. One day later, again I am getting “Incorrect or inaccessible application server URL”. Any idea to resolve this as I had reset my scanner more than 3 times. Appreciate anyone can help on this.

[josecgomez]

Peter any update on this?

[Mark_Wonsil]

This is the message we got with the incorrectly created certificate (see above). Generating a new cert using the PowerShell script created by @Chris Lorenz above fixed the issue for us. The other solution is to use a trusted cert instead of a self-signed one.

[lsjlee (Alvin Lee)]

Hi Mark, sorry I am not a technical guy. Does you mean that I need to generate a new cert in Epicor Server? Appreciate you can elaborate more in details. Thanks in advance.

[Mark_Wonsil]

You’ll need a new cert. I can’t tell which version of Kinetic that you’re on but I fairly sure that 2023.2 generates a good one and 2021.2 and earlier does not.

You can also use the PowerShell script noted in the other thread above to be sure. Do read that thread to get more details.

[lsjlee (Alvin Lee)]

The weird part is after i done factory reset on the scanner, then it can be used. Not long after then again the error came. I try not to disturb Epicor server. If i generate new certificate then it will affect all client workstation. Is there any other solutions that I can perform on the scanner itself?

[pphillips (Peter Phillips)]

Hi Jose,

For customers who use self-signed certificates, a recent Chrome update now requires certificates to have a Key Usage field in the certificate.

Windows Server 2022 will have this field in their self-signed certs, whereas older Windows OS’ will not.

Please refer to section “Login to system using self-signed certificate” in the below article for ways to get a self-signed cert with a Key Usage field onto older Windows Server operating systems.

https://biscit.atlassian.net/wiki/spaces/BP/pages/2397044741/Login#Login-to-system-using-self-signed-certificate

[Mark_Wonsil]

Others have reported the same behavior and the only solution was the new certificate. This is a new requirement in Chrome.