SolarWinds Job Engine V3 Credentials certificate shows “All the intended purposes of this certificate could not be verified” in Windows

2/24/2026 11:51 PM

2/24/2026 11:51 PM

This article explains why Windows may display the message:

“All the intended purposes of this certificate could not be verified.”

for the SolarWinds Job Engine V3 Credentials certificate, even though the Certification Path reports “This certificate is OK.” It clarifies that, in this context, the message is cosmetic and does not indicate a broken or untrusted SolarWinds certificate when the chain status is OK.

When inspecting certificates on a SolarWinds server:

 

On the General tab for the same certificate, Windows displays:

 

No Job Engine v3 or CMS errors are necessarily present in logs or the SolarWinds Platform Service Manager; the only concern may be how the message appears.

Network Performance Monitor

1. Nature of the Job Engine V3 Credentials certificate

The Job Engine V3 Credentials certificate is one of several internal certificates managed by the Certificate Management Service (CMS). CMS generates and manages:

• Job Engine Client certificate (JobEngineV3Client)

• Job Engine Service certificate (JobEngineV3Service)

• Job Engine Credentials certificate (JobEngineV3Credentials)

The Credentials certificate is specifically used by Job Engine v3 to encrypt and decrypt credentials, not as a public-facing web server certificate.

These internal certificates are issued by SolarWinds Root CA and SolarWinds SCA and stored in the Local Machine / My (Personal) store, with keys in Windows key storage.

2. Windows “intended purposes” UI behavior

Windows attempts to interpret the certificate’s Enhanced Key Usage (EKU) and certain policy extensions into friendly “intended purposes” descriptions on the General tab (e.g., Server Authentication, Client Authentication).

For internal/application certificates that:

• Use custom or limited EKUs, or

• Are not intended as generic public Server Authentication / Client Authentication certs,

Windows may be unable to map all purposes into its predefined list. When that happens, it shows:

“All the intended purposes of this certificate could not be verified.”

even though the Certification Path verifies the chain as OK and the cert is fully trusted for its actual use.

This behavior is not unique to SolarWinds certificates; similar reports exist for other internal or wildcard certificates where the General tab shows this text despite a valid chain.

3. Why this is cosmetic in this scenario

Because:

• The Certification Path tab reports “This certificate is OK” for the full chain from SolarWinds Root CA down to SolarWinds Job Engine V3 Credentials, and

• The Job Engine V3 Credentials certificate is used internally for credential encryption/decryption as documented in CMS design docs,

the General-tab message reflects a UI limitation, not a trust failure. Windows simply cannot express all EKU/policy purposes in its friendly list for this internal cert type.

Step 1 – Verify the certificate chain

1. On the SolarWinds server, run certlm.msc.

2. Under Certificates (Local Computer) → Personal → Certificates, locate:

   • Issued to: SolarWinds Job Engine V3 Credentials

   • Issued by: SolarWinds SCA

3. Open the certificate and go to Certification Path.

4. Confirm:

   • The chain is SolarWinds Root CA → SolarWinds SCA → SolarWinds Job Engine V3 Credentials.

   • Certificate status: “This certificate is OK.”

If the status is OK, the certificate is valid and trusted.

Step 2 – Confirm CMS and Job Engine v3 are healthy

1. Open SolarWinds Platform Service Manager (or services.msc).

2. Verify:

   • SolarWinds Certificate Management Service is Running and Automatic.

   • SolarWinds Job Engine Service v3 is Running and Automatic.

3. If either service is stopped, start it and monitor logs:

   • %ProgramData%\SolarWinds\Logs\CertificateManagement

   • %ProgramData%\SolarWinds\Logs\JobEngine.v3

If both services are running and logs show no related certificate errors, no action is required for the “intended purposes” UI message.

Step 3 – When to ignore the message

You can safely treat the “All the intended purposes of this certificate could not be verified” message as cosmetic and take no further action when:

• Step 1 shows “This certificate is OK” on the Certification Path.

• Step 2 confirms CMS and Job Engine v3 are running without errors.

• There are no Job Engine‑related alerts or functional issues in the SolarWinds Platform.

Step 4 – When additional troubleshooting is required

If any of the following are true:

• Job Engine v3 is flapping (starting and stopping repeatedly).

• CMS logs show gRPC or connectivity errors (e.g., proxy issues returning HTTP 403, CMS not reachable).

• Job Engine logs show:

  • “Job is either corrupted or was encrypted with unknown certificate. Job will be removed.”

  • “Unknown certificate provided” or similar certificate mismatch errors.

then follow the appropriate troubleshooting path:

1. Job Engine v3 flapping / CMS not reachable

   • See “Job Engine v3 service flapping in the SolarWinds Platform after an upgrade due to BITS Proxy” for guidance on correcting BITS/HTTP proxy settings that break CMS connectivity.

2. “Job is either corrupted or was encrypted with unknown certificate”

   • This indicates jobs encrypted under an old or mismatched Job Engine certificate. Internal notes describe resolving this by regenerating the Job Engine service/credentials certificate and restarting Job Engine so new jobs are encrypted with the correct key.

   • Follow internal Job Engine v3 certificate‑reset procedures or contact SolarWinds Support for assistance.

3. Other Job Engine v3 / CMS issues

   • Refer to current Job Engine v3 and CMS troubleshooting KAs (for example, Job Engine v3 not starting, CMS gRPC errors, or APE Job Engine v3 health problems).