Installation of SolarWinds UAMS agent failed in SolarWinds Self-Hosted to SolarWinds Observability SaaS via Platform Connect or manual installation due to a missing selected ALPN property

There are two options to install the UAMS agent: via Platform Connect or by manual installation. However, this sometimes fails due to a missing selected ALPN property.

You can confirm this in the following log files: C:\ProgramData\SolarWinds\UAMSClient\log\errors.log or C:\ProgramData\SolarWinds\UAMSClient\log\uamsclient.log

Sample error:

time="2026-02-25T10:32:21.0425238-10:00" level=error msg="The Agent Manager (UAMS Client) registration with the SolarWinds Observability SaaS at uams.na-01.cloud.solarwinds.com:443 failed, will retry in 46 seconds. Please ensure that port :443 and the SolarWinds Observability SaaS URL are not blocked by firewall rules." attempt=0 client_id= error="rpc error: code = Unavailable desc = connection error: desc = \"transport: authentication handshake failed: credentials: cannot check peer: missing selected ALPN property. If you upgraded from a grpc-go version earlier than 1.67, your TLS connections may have stopped working due to ALPN enforcement. For more details, see: https://github.com/grpc/grpc-go/issues/434\""

SolarWinds Observability uses gRPC over TLS, which requires HTTP/2. HTTP/2 is negotiated during the TLS handshake using ALPN (Application-Layer Protocol Negotiation) with the value h2.

If:

• HTTP/2 / ALPN is blocked, or

• An SSL inspection / proxy device terminates TLS and removes ALPN h2,

then the connection falls back to HTTP/1.1 (which gRPC cannot use), and the TLS handshake fails with:

• transport: authentication handshake failed: credentials: cannot check peer: missing selected ALPN property

Result: the agent cannot register with SolarWinds Observability SaaS, so it never appears in the portal.

1. Check ALPN / HTTP/2 using OpenSSL

   Run the command below on the server where the agent is installed. Note: Make sure to replace "xx-yy" below. The endpoint URIs used to send collected data to SolarWinds Observability vary based on the data center your organization uses. You can find the data center your organization uses by referring to the URL you use to access SolarWinds Observability. In this sample URL, XX-YY denotes the data center name: https://my.XX-YY.cloud.solarwinds.com. Check this link here for reference. 

   1.  If there is no proxy:

      .\openssl.exe s_client -connect uams.xx-yy.cloud.solarwinds.com:443 -alpn h2 -servername uams.na-01.cloud.solarwinds.com 2>&1 | Select-String -Pattern "ALPN|Protocol"

      powershell

       

   2. If the server is behind a proxy:

      .\openssl.exe s_client -connect uams.xx-yy.cloud.solarwinds.com:443 -alpn h2 -servername uams.na-01.cloud.solarwinds.com -proxy <proxy-host>:<proxy-port> 2>&1 | Select-String -Pattern "ALPN|Protocol"

      powershell

       

   How to read the result:

   1. If you see ALPN protocol: h2 → HTTP/2 is working on this path.
   2. If you don’t see h2 or any ALPN line → HTTP/2 / ALPN is probably being blocked or changed by a proxy or SSL inspection.

2. Reach out to your network/security team

   Share the error from the logs and the OpenSSL output with the network/security team and ask them to:

   1. Find any SSL inspection / proxy / security device between the server and
      uams.xx-yy.cloud.solarwinds.com
      (for example: Zscaler, Netskope, Palo Alto, FortiGate, etc.).
   2. Configure an SSL inspection bypass for:
      1. uams.na-01.cloud.solarwinds.com

   This lets ALPN h2 pass through unchanged so gRPC can use HTTP/2.

3. Re-test ALPN after the change

   After the bypass is in place, run the same OpenSSL command again:

   .\openssl.exe s_client -connect uams.xx-yy.cloud.solarwinds.com:443 -alpn h2 -servername uams.na-01.cloud.solarwinds.com 2>&1 | Select-String -Pattern "ALPN|Protocol"
   powershell

   You should now see:

   ALPN protocol: h2

    

   This confirms that HTTP/2 with ALPN h2 is now allowed end-to-end.

4. Confirm the agent in SolarWinds Observability

   1. Check Platform Connect again:
      1. Registered / Connected / OTEL Accessible should all be Successful.
      2. The Network Collector agent should now appear in SolarWinds Observability SaaS.