Observability

Internal CA Certificate not selectable in Configuration Wizard and browser shows Connection Not Secure in the SolarWinds Platform

You may successfully bind an internally issued CA certificate in IIS for the SolarWinds Web Console, yet still see browser warnings indicating the connection is not secure and find that the certificate is not selectable in the SolarWinds Configuration Wizard.

First published date

3/2/2026 6:15 PM

Last published date

3/2/2026 6:15 PM

Overview

 

Product section

Hybrid Cloud Observability

Resolution

Resolution

Understand the Expected Behavior

    • Browser security warnings are expected until the internal CA and its full certificate chain are trusted on the client system.

    • The SolarWinds Configuration Wizard applies stricter validation than IIS and will only display certificates that fully meet its criteria.

    • Certificates that IIS accepts may still be hidden in the Configuration Wizard if any validation requirement is not met. 

       

What you’re seeing from the browser is expected until your internal CA is trusted on the client side. What you’re seeing from SolarWinds Configuration Wizard (only self‑signed cert available) is also expected, because SolarWinds filters out many “valid in IIS” certs and shows only those that meet its own criteria.

  • Browser warning about your internal CA:
    Normal until the CA chain is correctly trusted and hostname/SANs are consistent.

  • Configuration Wizard only offering the self‑signed “SolarWinds‑Orion” certificate:
    Also normal if:

    • Your internal CA cert is not fully trusted (chain, CRL, EKU, etc.), or

    • There’s any validation issue. CW will hide it, while IIS still allows it.



Verify Certificate Trust Chain

  • Ensure the root CA and all intermediate certificates are installed and trusted on the SolarWinds server.

  • Confirm that Certificate Revocation Lists (CRLs) are reachable and valid.

  • Verify the certificate is not expired or revoked.

Validate Required Certificate Attributes

  • The certificate must include a Subject Alternative Name (SAN) matching the server’s fully qualified domain name (FQDN).

  • The Common Name (CN) must match the FQDN or use a valid wildcard covering the server name.

  • The certificate must include Server Authentication in the Extended Key Usage (EKU).

  • Use a supported key algorithm such as RSA with a minimum key size of 2048 bits.

  • The certificate must not be self-signed unless the issuing CA is fully trusted in the environment.

 

Use an Appropriate Certificate Template

  • Use a certificate template that supports Server Authentication and SAN entries.

  • If generating the certificate internally, ensure the template allows SAN specification.

  • For components requiring Java keystores, use PKCS#12 format where applicable.

 

Re-run the Configuration Wizard

  • After correcting trust or attribute issues, re-run the SolarWinds Configuration Wizard.

  • Verify whether the internal CA certificate now appears as a selectable option.

  • If only the self-signed certificate is shown, recheck trust, EKU, and SAN configuration.

Confirm Certificate Validity

  • Validate the certificate chain using certificate management tools on the server.

  • Confirm hostname matching against CN or SAN.

  • Test the SSL connection using OpenSSL or trusted SSL validation tools.

  • Once the certificate appears in the Configuration Wizard dropdown, it indicates the certificate meets SolarWinds validation requirements.

Reference: Configure the SolarWinds Platform Web Console to use HTTPS