Network Management

Certificate Management Service unable to approve certificate for RabbitMQ when upgrading to SolarWinds Platform 2024.4 and above

When upgrading to SolarWinds Platform 2024.4 or later, users may encounter an issue where the Certificate Management Service (CMS) is unable to approve a certificate for RabbitMQ. This problem arises due to a registry setting blocking the CMS client certificate during the Configuration Wizard process. This article outlines the cause and provides resolution steps.

First published date

12/23/2024 4:46 PM

Last published date

11/20/2025 7:29 PM

Overview

In SolarWinds Platform 2024.4, SolarWinds introduced the Certificate Management Service (CMS) to enhance certificate management. CMS refers to several components:

  • Certificate management feature: Integrated into the SolarWinds Platform (OO, HCO).

  • Windows service host: Runs the certificate management functionality.

  • gRPC service: Facilitates certificate-related operations.

Key Details About CMS:

  • CMS requires compatible versions of both the .NET Runtime and ASP.NET Core Runtime.

  • The Configuration Wizard (CW) configures CMS, creates its database structures, and ensures the CMS client instance is initialized.

  • During startup, CMS generates the following certificates:

    • Root Certificate Authority (CA)

    • Subordinate Certificate Authority (SCA)

    • CM service certificate

    • CM client certificate

  • Certificates are stored in the database and in the Local Machine / My Certificate store, with keys stored in Windows key storage.

Product section

Network Performance Monitor

Cause

The issue arises because the Certificate Management Service (CMS) is designed to work exclusively with certificates stored in the Local Machine / My Certificate store. 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\SendTrustedIssuerList

However, the above registry setting when enabled (set to 1), interferes with the authentication process as described below:

  1. CMS uses two levels of authentication:

    • TLS level: Accepts any certificate.

    • Custom trusted store level: Validates the certificate chain and client certificate validity.

  2. With SendTrustedIssuerList enabled, the TLS-level authentication blocks client certificates because the required root certificates are located in the Local Machine / My store rather than in the trusted store location.

  3. This blockage prevents CMS from proceeding to the second level of authentication, resulting in the error "no client certificate found."

If this configuration is enabled, this limits the Configuration Wizard’s ability to issue a RabbitMQ certificate where the RabbitMQ service will not start properly due to the missing certificate and the upgrade will fail.

Resolution

A fix for this issue is included in SolarWinds Platform 2025.4. Consider upgrading your environment. If you can't upgrade, use the workaround below.

 

To disable the registry setting, follow the below steps:

  1. Navigate to the registry path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\SendTrustedIssuerList.

  2. Set the Enabled value to 0 (disabled).

  3. Restart the machine.

  4. Re-run the Configuration Wizard.

 

Important:

For SolarWinds Platform 2025.1 and above, CMS will be required, not just during the Configuration Wizard run. Ensure the SendTrustedIssuerList registry setting is permanently disabled to avoid issues.

 

Related Articles: