ARM Server fails to start due to expired internal certificates

Starting in ARM 2024.3 and above, new architecture relying on certificate-based authentication for internal communication was implemented. These certificates expire exactly one year after creation and are not renewed automatically. When it expires, the ARM service fails to start properly and restarts continuously. No user login is possible, and typical recovery actions such as reinstalling, restoring backups, or modifying configurations do not resolve the issue with the following error message:

Connection to server failed.

Please check the name of the server and port number.

If the server has been started recently, then it may currently perform a database schema update.
Please do not turn off or restart the server. Please wait on the completion of this process.
We are very sorry for the inconvenience.

If the connection problem persists the server-service might not be started or a network component like firewall or router is preventing successful communication.
Please contact your system administrator.

Example screenshot:

The connection to the ARM server was rejected. Please contact the ARM administrator. The application is probably not registered or the client certificate is invalid.

Verification

If the files in this directory were created exactly one year ago, the following steps may help resolve the issue.

Symptoms

• ARM service continuously restarts on the server
• After a reboot, No user login possible to web console
• Standard recovery methods ineffective
• armServer.log may state the following:

System.Runtime.Remoting.RemotingException: Can not connect to 'grpc://XXXXXX:55555/tracerServer'!gRPC error code: Unavailable 
gRPC detail: ACTION: Please check, that the target host (server, collector) is running in gRPC mode.

This issue occurs because the ARM server fails to start because the internal communication certificates have expired.

This issue has been resolved in ARM 2025.2.1.

Release notes 

Upgrade steps

Note: the certificates will still hard-expire 1 year after creation, but the ARM upgrade will offer the option to recreate them at the start of the upgrade process.

If you prefer not to upgrade immediately, follow the steps below to resolve the issue manually:

Step 1: Stop ARM Service

1. Open Services (services.msc) on the ARM server.
2. Locate ARM-Service.
3. Right-click and select Stop.

Step 2: Delete Expired Certificates

1. Navigate to the following folder:

C:\ProgramData\protected-networks.com\8MAN\cfg\security\server

2. Delete all contents of this folder, including the Migrate folder if it exists.
3. You may need to change security ownership of 2 of the certificate files in order to delete them.

Step 3: Restart Server (Recommended)

• If possible, restart the ARM server to ensure all services reload cleanly.

Step 4: Restart ARM Service and IIS (If Server Restart Is Not Possible)

1. Start the ARM-Service service again.
2. Restart IIS/Web Server by either:
   • Running the following command in an administrator-level Command Prompt:

     iisrestart

• Or, using the IIS Manager console:
  • Open IIS Manager (search for IIS).
  • Select the Web Server (hostname).
  • Right-click and choose Stop, then Start, or select Restart from the right-hand Actions pane..

Additional Steps for Collectors

If your Collectors are having issues reconnecting after resolving the certificate issue above, they may need similar steps performed.

• Delete the certificates in C:\ProgramData\protected-networks.com\8MAN\cfg\security\server, then proceed with the manually installed collector steps provided in How to register a manually installed collector in ARM

If you see similar login issues for remote ARM application installations, proceed with the following steps:

• Delete the local certificates for each user, located in C:\users\%username%\AppData\Local\SolarWinds_Worldwide,_LLC\ARM\ 
• Then, proceed to re-register the clients using the steps provided in How to register the ARM clients
• It's possible that login on the ARM server itself may be prevented if the certificates exist in the location given above for local profiles. This happens if the Register App link was used, and a token code input. This creates the certificates locally, even if they are not necessary on the ARM server. Delete the certificates folder in C:\users\%username%\AppData\Local\SolarWinds_Worldwide,_LLC\ARM\ for any user profile used on the ARM server.