Network Management

RabbitMQ Certificate cannot be created or RabbitMQ is not found during Configuration Wizard in the SolarWinds Platform

When running the Configuration Wizard, the wizard fails at the messaging/RabbitMQ configuration step. RabbitMQ does not start, and the Configuration Wizard reports that RabbitMQ cannot be reached or that configuring the message bus failed. Retrying the wizard produces the identical failure.

First published date

9/23/2026 7:24 PM

Last published date

9/23/2026 9:26 PM

Overview

This is distinct from the following, similar-looking but unrelated issues that can also block RabbitMQ configuration and should be ruled out first if the CMS log does not show the IdnMapping / ArgumentException signature above:

    • CMS certificate approval blocked by SendTrustedIssuerList registry setting — produces a PermissionDenied/"no client certificate found" signature in CMS trace logs; fixed permanently in Platform 2025.4.

    • RabbitMQ TLS cipher-suite mismatch — RabbitMQ log shows SERVER ALERT: Fatal - Insufficient Security - no_suitable_ciphers; TCP connectivity to port 5671 succeeds but the TLS handshake fails. Resolved by applying IIS Crypto "Best Practices" cipher suites on all polling engines/web servers.

Product section
Orion Platform
Cause
The server's Windows hostname starts or ends with a hyphen (for example, VM-Server-sw-). Per RFC 952/1123, a DNS hostname label cannot begin or end with a hyphen.


When the Certificate Management Service builds the Subject Alternative Name (SAN) extension for the new RabbitMQ certificate, .NET's IdnMapping.GetAscii() validates the hostname as a DNS name. The trailing (or leading) hyphen makes the name invalid, so IdnMapping.GetAscii() throws System.ArgumentException. CMS does not handle this exception; it propagates up through gRPC to the caller as a generic, masked error ("Exception was thrown by handler." / StatusCode="Unknown"), which is why the Configuration Wizard and dependent services show unrelated-looking TLS/gRPC failures instead of a clear hostname error.


Because the RabbitMQ certificate is never created, RabbitMQ cannot start, and the Configuration Wizard reports RabbitMQ as unreachable. Any other component that requests a certificate from the same Certificate Management Service (for example, the Feature Service or Kestrel's dynamic HTTPS certificate) can fail in the same way while the underlying certificate request is broken.


This invalid-hostname condition is commonly introduced by cloud-provisioned VMs (for example, Azure) that truncate a longer VM name to the 15-character NetBIOS limit, which can land the truncation immediately after a hyphen.


The Configuration Wizard's hostname pre-flight check does not currently block installation when the hostname is invalid in this way, so the condition is not caught until the RabbitMQ certificate is actually created.
Resolution
  1. 

    Confirm the cause by checking SolarWinds.CertificateManagementService.log (located under %ProgramData%\SolarWinds\Logs\CertificateManagement\) for the System.ArgumentException: Decoded string is not a valid IDN name error at the time the Configuration Wizard was run.
    

  2. 

    Rename the Windows server so the hostname does not start or end with a hyphen (for example, rename VM-Server-sw- to VM-Server-sw).
    

  3. 

    Restart the server.
    

  4. 

    Re-run the Configuration Wizard.
    



Caveat


If the Configuration Wizard run is against an already-running/partially-configured environment (not a fresh install), renaming the server after the fact can leave some components still referencing the old hostname, resulting in an inconsistent state between old-name and new-name references across services. Where possible, perform the hostname correction before the initial Configuration Wizard run. If the environment is already in production, evaluate this risk before renaming and re-running the wizard.