Network Management

Configuration wizard deletes the self-signed certificate created during configuration

When you select the Generate Self-Signed Certificate option in the Configuration wizard, the certificate is removed immediately after being created. Modify the group policy that deletes the certificate or use another certificate for the HTTPS binding.

First published date

12/18/2019 1:24 PM

Last published date

7/15/2021 12:55 PM

Overview

When you enable SSL and select Generate Self-Signed Certificate in the Configuration wizard, the certificate is deleted immediately after being created. 

Verify the following: 

  • Check that the browser warning includes the following message:
    NET::ERR_CERT_AUTHORITY_INVALID

  • In the Event Viewer, check the Application log and look for lines coming from the CAPI2 source with the following text in the Description:
    Successful auto delete of third-party root certificate.

  • Check the Trusted Root CA on Local Machine store and confirm that you cannot see a certificate with:
    Issued To = Issued By = hostname or FQDN

Product section

Orion Platform

Cause

The Orion Platform self-signed certificate is generated by the makecert tool and then is imported into both Personal and Trusted Root CA stores. Windows considers this to be a 3rd-party-generated trusted certificate  which might be subject to deletion by a certain Group Policy.

Resolution

To resolve the issue, modify the policy or use another certificate for HTTPS binding.

To modify the policy:

  1. Open Local Group Policy Editor (gpedit.msc).
    Note: If your computer is part of a domain, the policy has to be tweaked on Domain Controller via Group Policy Management (gpmc.msc) by editing an active policy located under Group Policy Objects.

  2. Drill down the policy tree:
    Computer Configuration > Administrative Templates > System > Internet Communication Management > Internet Communication Settings

  3. Click "Turn off Automatic Root Certificate Update" and Enable it (by default it's not configured or Disabled)
If you cannot change the policy, generate a self-signed certificate using Windows toolset (e.g. via IIS Manager action "Create Self-Signed Certificate..") and use it for Orion Website configuration. This certificate is not affected by the policy because of its origin (the OS itself).