Observability

Certificate Validation Changes in SolarWinds Platform 2025.2 – HTTPS Alert Actions, PDF Export, and Geolocation May Fail After Upgrade

This article provides information about changes introduced in SolarWinds Platform 2025.2 that enforce SSL certificate validation on all outbound HTTPS connections. Customers may experience failures in alert actions, PDF report exports, or geolocation services if connected endpoints use invalid, self-signed, or untrusted certificates.

First published date

7/2/2025 11:37 PM

Last published date

7/9/2025 7:31 PM

Overview

In SolarWinds Platform 2025.2, SSL certificate validation is now enforced by default for all HTTPS connections. This enhancement is part of a security hardening initiative and is documented in the 2025.2 release notes under the following entry:

"All HTTPS connections are now performed with SSL certificate validation. The SSL certificate validation is configurable via Centralized Settings."

 

Affected features include:

  • Alert actions configured to send data to HTTPS endpoints (e.g., ServiceNow, Slack, Teams)
  • Geolocation map data retrieval
  • PDF export of reports and alerts using the default rendering engine

If these features communicate with a server using:

  • A self-signed certificate
  • A certificate with a mismatched hostname (CN/SAN)
  • An expired or revoked certificate
  • A certificate not trusted by the system's certificate store

...they will fail due to certificate validation errors.

 

Common errors or symptoms:

  • Alert action fails silently or does not trigger
  • Exported PDF file is blank or missing expected content
  • Geolocation does not render
  • Logs may include messages such as:

    The SSL connection could not be established, see inner exception.
    The remote certificate is invalid according to the validation procedure.

Product section

Hybrid Cloud Observability

Cause

This issue is caused by the introduction of stricter SSL certificate validation behavior in 2025.2. By default, all HTTPS communication now requires:

  • Valid certificate chains
  • Proper hostname matching (no mismatch between certificate CN/SAN and target hostname)
  • Successful revocation checks (CRL or OCSP)

If any of these conditions are not met, HTTPS communication is blocked unless overrides are applied.

Resolution

Step 1: Identify all outbound HTTPS usage

Review alert actions, integration tools, PDF exports, and any custom features or scripts that connect to HTTPS endpoints.

Step 2: Validate certificate configurations

Ensure that all target HTTPS endpoints:

  • Use certificates issued by a trusted Certificate Authority (CA)
  • Have no name mismatches
  • Are not expired or revoked
  • Have a complete chain of trust

If internal/self-signed certs are used:

  • Import the internal root CA into the Trusted Root Certification Authorities store on all SolarWinds servers and polling engines.

Step 3: (Optional) Apply overrides for legacy or temporary exceptions

  1. To allow exceptions for specific alert actions: 
-- Scripts are not supported under any SolarWinds support program or service.
-- Scripts are provided AS IS without warranty of any kind. SolarWinds further
-- disclaims all warranties including, without limitation, any implied warranties
-- of merchantability or of fitness for a particular purpose. The risk arising
-- out of the use or performance of the scripts and documentation stays with you.
-- In no event shall SolarWinds or anyone else involved in the creation,
-- production, or delivery of the scripts be liable for any damages whatsoever
-- (including, without limitation, damages for loss of business profits, business
-- interruption, loss of business information, or other pecuniary loss) arising
-- out of the use of or inability to use the scripts or documentation.

INSERT INTO [dbo].[WebSettings] VALUES ('ActionsRemoteCertificateValidationOverrideEnabled','true')

 

2. Then navigate to the Advanced Configuration page (Centralized Settings) on the SolarWinds Platform server, to adjust certificate validation behavior:

 

https://<SolarWindsServerIP>/orion/admin/advancedconfiguration/global.aspx


For alert actions:

  • Locate SolarWinds.Orion.Core.Actions.Settings.ActionSettings
    • CheckOnCertificateChainErrors = false
    • CheckOnCertificateNameMismatch = false
    • CheckOnCertificateRevocation = false
      For PDF export:
  • Locate ExportToPdfCmd.ExportToPdfSettings
    • CheckOnCertificateChainErrors = false
    • CheckOnCertificateChainErrorsAndNameMismatch = false

 

Use these overrides only after exhausting secure remediation options, such as correcting certificate configuration.

 

Note:

Use these overrides only when necessary and after confirming that the certificate validation failure is the root cause. These settings lower the security enforcement level.