Meraki API Integration Fails with “Failed to Get List of Organizations” After Upgrading to SolarWinds Platform 2025.2

• The API key provided is valid and has administrative privileges.
• All required steps from the official Monitor Meraki wireless infrastructure documentation have been followed.
• Internet connectivity and communication to api.meraki.com are confirmed.

The issue may arise due to one or more of the following:

1. Missing Certificates:
   The SolarWinds server does not trust the SSL certificate chain presented by api.meraki.com because the following certificates may be missing from the server’s certificate trust store:
• Intermediate Certificate Authority (CA): HydrantID Server CA O1
• Root Certificate Authority (CA): IdenTrust Commercial Root CA 1
2. CRL Access Failure:
   The SolarWinds server cannot connect to the Certificate Revocation List (CRL) endpoint at http://validation.identrust.com to verify the certificate’s revocation status. This is often caused by firewall restrictions, DNS issues, or proxy settings blocking outbound access. It may result in errors such as RevocationStatusUnknown or OfflineRevocation.
3. Manual CRL Installation May Be Required:
   In some environments, especially where outbound CRL access is restricted or fails silently, manually importing the CRL file into the local certificate store can restore the connection.
   Example steps:
• Download CRL file:
  http://validation.identrust.com/crl/hydrantidcao1.crl
• Import it using the following command in an elevated command prompt:
  

  certutil -addstore "CA" "C:\Path\To\hydrantidcao1.crl"

4. Certificate Changes by Meraki
   As part of routine security maintenance, Cisco Meraki may rotate their RADIUS authentication certificates. These changes can introduce stricter certificate validation requirements or updated Certificate Revocation List (CRL) distribution points.

To resolve the issue, install the missing intermediate and root certificates on the SolarWinds server:

1. Identify the Missing Certificates

Use a browser, SSL inspection tool, or openssl to review the certificate chain from https://api.meraki.com.

2. Download the Required Certificates

Visit the certificate provider’s website or use your browser to export the following:

• • HydrantID Server CA O1 (intermediate)

  • IdenTrust Commercial Root CA 1 (root)

3. Import Certificates into the Trusted Store

To import certificates into the trusted store, use any one of the below optional methods:

Option A: Using Command Prompt

1. 1. Transfer the .crt files to the server (e.g., C:\Temp\).

   2. Open Command Prompt as Administrator and run:

certutil -addstore root C:\Temp\root-download-x3.crt certutil -addstore CA C:\Temp\hydrantid-intermediate.crt

Option B: Using MMC (GUI)

4. 1. Press Win + R, type mmc, and press Enter.

   2. Go to File > Add/Remove Snap-in.

   3. Select Certificates, then click Add.

   4. Choose Computer account > Local computer, then click Finish.

   5. Import the root certificate into Trusted Root Certification Authorities.

   6. Import the intermediate certificate into Intermediate Certification Authorities.

4. Verify Installation

Run this PowerShell command:

Get-ChildItem -Path Cert:\LocalMachine\Root | Where-Object { $_.Subject -like "*IdenTrust Commercial Root CA 1*" }

5. Retry Meraki API Integration

Return to the SolarWinds Web Console and try adding the Meraki organization again.

Troubleshoot CRL Access Issues

If the certificate chain is trusted but the error persists with logs showing RevocationStatusUnknown,OfflineRevocation, the SolarWinds server may be unable to access the CRL endpoint (validation.identrust.com). Follow these steps:

1. Perform a DNS Lookup for CRL Endpoint
   1. Open Command Prompt on the SolarWinds server: 
      • Press Win + R, type cmd, and press Enter.
   2. Run the following command to identify the IP(s) for validation.identrust.com:
      

      nslookup validation.identrust.com

   3. Note the resolved IP(s) (e.g., 192.35.177.64). Multiple IPs may be returned due to load balancing.
      
      
2. Whitelist CRL Endpoint in Firewall
   1. Contact your firewall administrator to whitelist all resolved IPs for validation.identrust.com for outbound access.
   2. Ensure ports 80 and/or 443 are open for these IPs, as CRL checks typically use these ports.
   3. Verify connectivity to the CRL endpoint from the SolarWinds server using a tool like telnet or Test-NetConnection in PowerShell:
      

      Test-NetConnection -ComputerName validation.identrust.com -Port 80

3. Manually Add CRL File to Certificate Store
   If whitelisting the CRL endpoint does not resolve the issue or firewall adjustments are not feasible:
   1. Download the CRL file from http://validation.identrust.com/crl/hydrantidcao1.crl.
   2. Save the file to a location on the SolarWinds server (e.g., C:\Temp\hydrantidcao1.crl). 
   3. Run the following command as Administrator to add the CRL to the certificate store:

      certutil -addstore "CA" "C:\Temp\hydrantidcao1.crl"

       

4. Test Meraki API Integration
   Return to the SolarWinds Web Console and try adding the Meraki organization again. If the issue persists, proceed below for a temporary workaround.

Temporarily Disable CRL Checking (Not Recommended)

If CRL access cannot be immediately resolved, temporarily disable CRL checking to isolate the issue. This is not recommended for production environments due to security risks.

1. Disable CRL Checking
   1.  Open Internet Options:
      • Press Win + R, type inetcpl.cpl, and press Enter.
   2. Go to the Advanced tab and scroll to the Security section.
   3. Uncheck the option:
      • Check for server certificate revocation
   4. Click Apply > OK.
   5. Restart the SolarWinds application or server to apply changes.
      
      
2. Test Meraki API Integration
   1. Return to the SolarWinds Web Console and try adding the Meraki organization.
   2. If successful, the issue is confirmed to be related to CRL access.
      
      
3. Restore CRL Checking
   1. Once CRL access is resolved (e.g., firewall whitelisting completed), re-enable CRL checking:
      • Open Internet Options (inetcpl.cpl).
      • Go to Advanced > Security.
      • Re-check Check for server certificate revocation.
      • Click Apply > OK and restart the SolarWinds application.
   2. Retest the Meraki API integration to ensure it works with CRL checking enabled.

Check Advanced Certificate Validation Setting

• Go to Advanced Configuration in SolarWinds
• Locate CheckOnCertificateRevocation
• Set to False if strict revocation checking is not required

Note: This setting is optional. By default, SolarWinds checks only:

• • TLS chain trust
  • Certificate name matching

These two checks cannot be disabled for security reasons.