"Failed to setup RabbitMQ for SolarWinds Platform" when SendTrustedIssuerList registry key is enabled after upgrading to SolarWinds Platform 2024.4 and above

SolarWinds internal Certification Authorities are not stored in the system trusted certificate stores. When SendTrustedIssuerList is enabled, the system only allows client certificates signed by trusted Certification Authorities, causing the SolarWinds client certificate to be rejected.

If this issue occurs, the Configuration Wizard fails with the following error message:

Failed to setup RabbitMQ for SolarWinds Platform

While the failed to setup RabbitMQ for SolarWinds Platform message can have multiple causes. This article covers the specific scenarios related to Certificate Management Service (CMS) failing where:

• RabbitMQ service is missing or not properly installed after upgrading to SolarWinds Platform 2024.4 and above
• CMS service is running, but configuration wizard fails due to CMS or RabbitMQ issues

Additional steps are required to determine if it is caused by the SendTrustedIssuerList registry key.

To check if the SendTrustedIssuerList registry key is enabled:

• Open Windows Registry Editor

• Navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\SendTrustedIssuerList

• If the key is present and set to 1, it is enabled

Another way to verify if this error has occurred is to enable DEBUG-level logging for the Certificate Management Service in the Log Adjuster, rerun the Configuration Wizard, and check the Certificate Management service logs (located at C:\ProgramData\SolarWinds\Logs\CertificateManagement) for the following sequence of logs:

DEBUG Microsoft.AspNetCore.Authentication.Certificate.CertificateAuthenticationHandler - (null) No client certificate found.

DEBUG Microsoft.AspNetCore.Authentication.Certificate.CertificateAuthenticationHandler - (null) AuthenticationScheme: Certificate was not authenticated.

DEBUG Microsoft.AspNetCore.Authorization.AuthorizationMiddleware - (null) Policy authentication schemes did not succeed

INFO Microsoft.AspNetCore.Authorization.DefaultAuthorizationService - (null) Authorization failed. Fail() was explicitly called.

INFO Microsoft.AspNetCore.Authentication.Certificate.CertificateAuthenticationHandler - (null) AuthenticationScheme: Certificate was challenged.

INFO Microsoft.AspNetCore.Hosting.Diagnostics - (null) Request finished HTTP/1.1 POST https://localhost:17732/CertificateManagement.CertificateManagement/GetCaCertificate - 403 0

The SendTrustedIssuerList key is enabled in the registry,  causing the SolarWinds client certificate to be rejected.

Either disable the SendTrustedIssuerList registry key or follow the steps below to add our internal Certification Authorities to the system's trusted certificate stores.

1. Open the Local Computer / Personal store with mmc

   1. Open mmc.exe

   2. From File menu, select Add/Remove Snap In

   3. From the Available snap-ins, select Certificates, then select Add

   4. Select Computer Account, then select Next

   5. In the Select Computer windows, select Local Computer, and then select Finish

   6. In the Console Root panel, select Certificates (Local Computer), and then Personal

2. In the Certificates folder, locate SolarWinds Root CA certificate and copy it into Trusted Root Certification Authorities

3. In the Certificates folder, locate SolarWinds SCA certificate and copy it into the Certificates folder within Intermediate Certification Authorities

Note: The SolarWinds Root CA and SolarWinds SCA certificates must be copied to the trusted stores to ensure they also remain available in the Local Computer / Personal certificate store, where CMS requires them for proper functionality.

After completing these steps, the Configuration Wizard will be able to authenticate with the Certificate Management Service and will run as expected.