Observability

Last installation of agent failed HCO to SolarWinds Observability via Platform Connect

This article provides guidance and troubleshooting steps on how to resolve the error "Last installation of agent failed" in the Platform Connect wizard.

First published date

1/24/2024 6:03 PM

Last published date

9/2/2026 4:41 PM

Overview

When setting up Platform Connect, you may experience the following error:

Last installation of agent failed
All 3 attempts to install failed. Input string was not in a correct format.
Retry installation Uninstall agent

Product section

SolarWinds Observability

Cause

You may experience this error as SWOSH (formerly HCO) on the main polling engine is not able to download the UAMS Agent. This could be due to the following:

Certificate validation fails due to OCSP endpoints being blocked
Installer download fails or connection to SWO SaaS fails as the URLs are blocked
The anti-virus installed on the SWOSH server does not allow the UAMS Agent to be saved to the disk when downloading

Resolution

In order to resolve this, you need to ask your Network/Firewall Team to do the following:

Permit outbound connections to the following endpoints using port 443. Check this link here for reference - Note: Make sure to replace "xx-yy" below. The endpoint URIs used to send collected data to SolarWinds Observability vary based on the data center your organization uses. You can find the data center your organization uses by referring to the URL you use to access SolarWinds Observability. In this sample URL, XX-YY denotes the data center name: https://my.XX-YY.cloud.solarwinds.com.):
1. uams.xx-yy.cloud.solarwinds.com
2. otel.collector.xx-yy.cloud.solarwinds.com
3. agent-binaries.cloud.solarwinds.com
4. *.global.cloud.solarwinds.com
Permit HTTP outbound connections to the following endpoints using port 80 for certificate validation:
1. ocsp.rootg2.amazontrust.com
2. ocsp.r2m03.amazontrust.com
3. ocsp.r2m04.amazontrust.com
4. o.ss2.us
5. s.ss2.us
If the above endpoints have been allowed in the firewall, but you are still getting the error message, please use the following PowerShell script to check the certificate validity. Run it on your main polling engine. It prints out all certificates, OCSP URLs, CRL URLs and the state of the certificate. Instructions to run the script:
1. Create “C:/Temp” folder
2. Copy and paste the script in your PowerShell Terminal (there is no need to modify the script)

$url = "https://agent-binaries.cloud.solarwinds.com/uams/latest/uamsclient.msi "
$output = "c:\Temp\uamsclient.msi"
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
[Net.ServicePointManager]::ServerCertificateValidationCallback = {
    param(
        [object]$sender,
        [Security.Cryptography.X509Certificates.X509Certificate] $certificate, 
        [Security.Cryptography.X509Certificates.X509Chain] $chain, 
        [Net.Security.SslPolicyErrors] $sslPolicyErrors
    )
    write-host "CertificateValidation CRL started..."
    $chain.ChainPolicy.RevocationMode = [System.Security.Cryptography.X509Certificates.X509RevocationMode]::Online
    $cert2 = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2($certificate)
    $result = $chain.Build($cert2)
    write-host "CertificateValidation CRL finished: $result"

    $chain.ChainElements | ForEach-Object {
        $cert = $_.Certificate
        $status = $_.ChainElementStatus
        $cert
        if ($ext = $cert.Extensions["Authority Information Access"]) {$ext.Format($true)}
        if ($ext = $cert.Extensions["CRL Distribution Points"]) {$ext.Format($true)}
        "[Status]"
        if ($status) { $status.StatusInformation } else { "OK" }
        "#" * 24 
    } | write-host
    $result
}
$wc = New-Object System.Net.WebClient
write-host($output)
write-host($url)
$wc.DownloadFile($url, $output)

NOTES:

We encountered issues when running the script in PowerShell 7+, and it might fail. If this happens, try it in an older version.
An easy way how to check your PowerShell version is to write $psversiontable in the PowerShell terminal.

See the below example of how the output of the script may look if successful. You can see info about all the certificates in the chain. Note that the certificate chain can change, so you may see different certificates. Certificates are separated from each other with ################ . This output means that there are no connectivity issues and you should be able to set up Platform Connect successfully.

CertificateValidation CRL started...
CertificateValidation CRL finished: True
[Subject]
  CN=*.global.cloud.solarwinds.com

[Issuer]
  CN=Amazon RSA 2048 M03, O=Amazon, C=US

[Serial Number]
  038CAC0F8011C370946C9ED6DEB1510A

[Not Before]
  3/6/2024 1:00:00 AM

[Not After]
  4/5/2025 1:59:59 AM

[Thumbprint]
  B716A678A21202666FE129DB66BC603F5D08CF00

[1]Authority Info Access
     Access Method=On-line Certificate Status Protocol (1.3.6.1.5.5.7.48.1)
     Alternative Name:
          URL=http://ocsp.r2m03.amazontrust.com
[2]Authority Info Access
     Access Method=Certification Authority Issuer (1.3.6.1.5.5.7.48.2)
     Alternative Name:
          URL=http://crt.r2m03.amazontrust.com/r2m03.cer

[1]CRL Distribution Point
     Distribution Point Name:
          Full Name:
               URL=http://crl.r2m03.amazontrust.com/r2m03.crl

[Status]
OK
########################
[Subject]
  CN=Amazon RSA 2048 M03, O=Amazon, C=US

[Issuer]
  CN=Amazon Root CA 1, O=Amazon, C=US

[Serial Number]
  0773124CD406D267C0991CDD299A9F38317985

[Not Before]
  8/24/2022 12:26:04 AM

[Not After]
  8/24/2030 12:26:04 AM

[Thumbprint]
  D9FE0A65FA00CABF61F5120D373A8135E1461F15

[1]Authority Info Access
     Access Method=On-line Certificate Status Protocol (1.3.6.1.5.5.7.48.1)
     Alternative Name:
          URL=http://ocsp.rootca1.amazontrust.com
[2]Authority Info Access
     Access Method=Certification Authority Issuer (1.3.6.1.5.5.7.48.2)
     Alternative Name:
          URL=http://crt.rootca1.amazontrust.com/rootca1.cer

[1]CRL Distribution Point
     Distribution Point Name:
          Full Name:
               URL=http://crl.rootca1.amazontrust.com/rootca1.crl

[Status]
OK
########################
[Subject]
  CN=Amazon Root CA 1, O=Amazon, C=US

[Issuer]
  CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, S=Arizona, C=US

[Serial Number]
  067F944A2A27CDF3FAC2AE2B01F908EEB9C4C6

[Not Before]
  5/25/2015 2:00:00 PM

[Not After]
  12/31/2037 2:00:00 AM

[Thumbprint]
  06B25927C42A721631C1EFD9431E648FA62E1E39

[1]Authority Info Access
     Access Method=On-line Certificate Status Protocol (1.3.6.1.5.5.7.48.1)
     Alternative Name:
          URL=http://ocsp.rootg2.amazontrust.com
[2]Authority Info Access
     Access Method=Certification Authority Issuer (1.3.6.1.5.5.7.48.2)
     Alternative Name:
          URL=http://crt.rootg2.amazontrust.com/rootg2.cer

[1]CRL Distribution Point
     Distribution Point Name:
          Full Name:
               URL=http://crl.rootg2.amazontrust.com/rootg2.crl

[Status]
OK
########################
[Subject]
  CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, S=Arizona, C=US

[Issuer]
  OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US

[Serial Number]
  00A70E4A4C3482B77F

[Not Before]
  9/2/2009 2:00:00 AM

[Not After]
  6/28/2034 7:39:16 PM

[Thumbprint]
  9E99A48A9960B14926BB7F3B02E22DA2B0AB7280

[1]Authority Info Access
     Access Method=On-line Certificate Status Protocol (1.3.6.1.5.5.7.48.1)
     Alternative Name:
          URL=http://o.ss2.us/
[2]Authority Info Access
     Access Method=Certification Authority Issuer (1.3.6.1.5.5.7.48.2)
     Alternative Name:
          URL=http://x.ss2.us/x.cer

[1]CRL Distribution Point
     Distribution Point Name:
          Full Name:
               URL=http://s.ss2.us/r.crl

[Status]
OK
########################
[Subject]
  OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US

[Issuer]
  OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US

[Serial Number]
  00

[Not Before]
  6/29/2004 7:39:16 PM

[Not After]
  6/29/2034 7:39:16 PM

[Thumbprint]
  AD7E1C28B064EF8F6003402014C3D0E3370EB58A

[Status]
OK
########################

Meanwhile, below is an example output of the script for unsuccessful installation of UAMS agent. This means that there's a connectivity issue and the UAMS client install will most likely fail. Check again that all required URLs are allowed in the firewall:

CertificateValidation CRL started...

CertificateValidation CRL finished: False

[Subject]

  CN=*.global.cloud.solarwinds.com

 

[Issuer]

  CN=Amazon RSA 2048 M03, O=Amazon, C=US

 

[Serial Number]

  038CAC0F8011C370946C9ED6DEB1510A

 

[Not Before]

  3/5/2024 4:00:00 PM

 

[Not After]

  4/4/2025 4:59:59 PM

 

[Thumbprint]

  B716A678A21202666FE129DB66BC603F5D08CF00

 

[1]Authority Info Access

     Access Method=On-line Certificate Status Protocol (1.3.6.1.5.5.7.48.1)

     Alternative Name:

          URL=http://ocsp.r2m03.amazontrust.com

[2]Authority Info Access

     Access Method=Certification Authority Issuer (1.3.6.1.5.5.7.48.2)

     Alternative Name:

          URL=http://crt.r2m03.amazontrust.com/r2m03.cer

 

[1]CRL Distribution Point

     Distribution Point Name:

          Full Name:

               URL=http://crl.r2m03.amazontrust.com/r2m03.crl

 

[Status]

The revocation function was unable to check revocation for the certificate.

 

The revocation function was unable to check revocation because the revocation server was offline.

 

########################

[Subject]

  CN=Amazon RSA 2048 M03, O=Amazon, C=US

 

[Issuer]

  CN=Amazon Root CA 1, O=Amazon, C=US

 

[Serial Number]

  0773124CD406D267C0991CDD299A9F38317985

 

[Not Before]

  8/23/2022 3:26:04 PM

 

[Not After]

  8/23/2030 3:26:04 PM

 

[Thumbprint]

  D9FE0A65FA00CABF61F5120D373A8135E1461F15

 

[1]Authority Info Access

     Access Method=On-line Certificate Status Protocol (1.3.6.1.5.5.7.48.1)

     Alternative Name:

          URL=http://ocsp.rootca1.amazontrust.com

[2]Authority Info Access

     Access Method=Certification Authority Issuer (1.3.6.1.5.5.7.48.2)

     Alternative Name:

          URL=http://crt.rootca1.amazontrust.com/rootca1.cer

 

[1]CRL Distribution Point

     Distribution Point Name:

          Full Name:

               URL=http://crl.rootca1.amazontrust.com/rootca1.crl

 

[Status]

OK

########################

[Subject]

  CN=Amazon Root CA 1, O=Amazon, C=US

 

[Issuer]

  CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, S=Arizona, C=US

 

[Serial Number]

  067F944A2A27CDF3FAC2AE2B01F908EEB9C4C6

 

[Not Before]

  5/25/2015 5:00:00 AM

 

[Not After]

  12/30/2037 5:00:00 PM

 

[Thumbprint]

  06B25927C42A721631C1EFD9431E648FA62E1E39

 

[1]Authority Info Access

     Access Method=On-line Certificate Status Protocol (1.3.6.1.5.5.7.48.1)

     Alternative Name:

          URL=http://ocsp.rootg2.amazontrust.com

[2]Authority Info Access

     Access Method=Certification Authority Issuer (1.3.6.1.5.5.7.48.2)

     Alternative Name:

          URL=http://crt.rootg2.amazontrust.com/rootg2.cer

 

[1]CRL Distribution Point

     Distribution Point Name:

          Full Name:

               URL=http://crl.rootg2.amazontrust.com/rootg2.crl

 

[Status]

OK

########################

[Subject]

  CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, S=Arizona, C=US

 

[Issuer]

  OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US

 

[Serial Number]

  00A70E4A4C3482B77F

 

[Not Before]

  9/1/2009 5:00:00 PM

 

[Not After]

  6/28/2034 10:39:16 AM

 

[Thumbprint]

  9E99A48A9960B14926BB7F3B02E22DA2B0AB7280

 

[1]Authority Info Access

     Access Method=On-line Certificate Status Protocol (1.3.6.1.5.5.7.48.1)

     Alternative Name:

          URL=http://o.ss2.us/

[2]Authority Info Access

     Access Method=Certification Authority Issuer (1.3.6.1.5.5.7.48.2)

     Alternative Name:

          URL=http://x.ss2.us/x.cer

 

[1]CRL Distribution Point

     Distribution Point Name:

          Full Name:

               URL=http://s.ss2.us/r.crl

 

[Status]

OK

########################

[Subject]

  OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US

 

[Issuer]

  OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US

 

[Serial Number]

  00

 

[Not Before]

  6/29/2004 10:39:16 AM

 

[Not After]

  6/29/2034 10:39:16 AM

 

[Thumbprint]

  AD7E1C28B064EF8F6003402014C3D0E3370EB58A

 

[Status]

OK

########################

Exception calling "DownloadFile" with "2" argument(s): "The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel."

At line:32 char:1

+ $wc.DownloadFile($url, $output)

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException

    + FullyQualifiedErrorId : WebException

In the above example, the certificate to install the UAMS agent wasn't able to be verified on these lines:

[1]Authority Info Access

     Access Method=On-line Certificate Status Protocol (1.3.6.1.5.5.7.48.1)

     Alternative Name:

          URL=http://ocsp.r2m03.amazontrust.com

[2]Authority Info Access

     Access Method=Certification Authority Issuer (1.3.6.1.5.5.7.48.2)

     Alternative Name:

          URL=http://crt.r2m03.amazontrust.com/r2m03.cer

 

[1]CRL Distribution Point

     Distribution Point Name:

          Full Name:

               URL=http://crl.r2m03.amazontrust.com/r2m03.crl

 

[Status]

The revocation function was unable to check revocation for the certificate.

 

The revocation function was unable to check revocation because the revocation server was offline.

Therefore, ocsp.r2m03.amazontrust.com URL on port 80 must be allowed on the firewall rule in this example.

You may also try to disable any Antivirus installed on the main polling engine and retry with the Platform Connect configuration. If the above endpoints have been allowed on your firewall but the issue persists, please provide us the following in your support case:

Copy of the PowerShell script output above
Screenshots of your firewall rules showing that all the required endpoints above have been allowed
Collect diagnostic logs by following this link here
Copy of your firewall rule logs

If you are not permitted to allow the required endpoints in port 80 in your firewall, another workaround is to manually install the SolarWinds UAMS Client. Please contact Support for more information about the manual installation procedure.

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same if any.