Troubleshoot issues with the Web Console's SSL certificate with the SolarWinds Platform

10/25/2018 1:47 AM

1/26/2026 4:48 PM

You may experience the following symptoms with the Web Console when it is configured to use SSL. 

• The web browser cannot establish an HTTPS connection.
• The web browser says "This page can't be displayed".
• The web browser returns something similar to the following error: "Your connection is not secure."
• The top menu disappears.
• Scheduled Reports fail exporting or generate bad output (e.g. blank PDF files)
  • For more details on PDF Report exports, see Scheduled Report PDF Attachments Show Blank Page After Upgrade to SolarWinds Platform 2025.2

With Chrome browser, the following error message may appear:

 

• NET::ERR_CERT_AUTHORITY_INVALID: The certificate authority that issued the website's SSL certificate is not trusted.
• NET::ERR_CERT_COMMON_NAME_INVALID: The domain name in the SSL certificate does not match the domain you are trying to reach.
• NET::ERR_CERT_DATE_INVALID: The certificate's date validity is not in sync with your computer's date and time.

If you run the SolarWinds Active Diagnostics tool, the "Check site certificates" test fails with one of the following descriptions:

• The certificate assigned to https://webconsole.host:port binding is not found in the certificates store.
• The certificate assigned to https://webconsole.host:port binding is invalid.
• The certificate assigned to https://webconsole.host:port binding is not a server certificate.
• The certificate assigned to https://webconsole.host:port binding is revoked or parent certificates in the chain are revoked.
• The certificate assigned to https://webconsole.host:port binding can not be used for client authentication.
• The certificate assigned to https://webconsole.host:port binding does not match.
• The certificate assigned to https://webconsole.host:port binding does not have read permissions for the application pool user [User] to access the private key.

https://webconsole.host:port is your full Orion Web Console website binding information, including hostname and TCP port number.

Orion Platform

This issue occurs because of one of the following reasons: 

• Certificate Authority (CA) is not installed as a Trusted Root Certificate Authority.  If the certificate is self-signed, it will inherently not be trusted by default.
• The domain name (Common Name) does not match the domain name in the address bar of the browser.
• The certificate date validity does not match the computer's date and time.

The following messages are specific to the SolarWinds Active Diagnostics:

The certificate assigned to https://webconsole.host:port binding is not found in the certificates store.

The SSL certificate may be deleted from the certificates store.

The certificate assigned to https://webconsole.host:port binding is invalid.

The SSL certificate is invalid, for reasons such as:

• It is expired
• It is self-signed and is not placed into the Trusted Root Certification Authorities store,
• The parent certificate in the chain is not found

The certificate assigned to https://webconsole.host:port binding is not a server certificate.

The SSL certificate does not have "Server Authentication" selected or it is disabled.

The certificate assigned to https://webconsole.host:port binding is revoked or parent certificates in the chain are revoked.

The SSL certificate is revoked or the parent certificates in the chain are revoked.

The certificate assigned to https://webconsole.host:port binding can not be used for client authentication.

The IIS Client Certificates Mapping Authentication module is installed and the Client certificates setting in the SSL Settings for the Orion Web Console site is set to Require. In that case, the SSL certificates must have "Client Authentication" selected and be enabled.

The certificate assigned to https://webconsole.host:port binding does not match.

The SSL certificate Issued To (CN) field does not match the server's FQDN nor partially matches FQDN using wildcards.

The certificate assigned to https://webconsole.host:port binding does not have read permissions for the application pool user [User] to access the private key.

The SSL certificate does not have read permissions for the application used to access the private key. 

 

Important! By default, the web console will create a self-signed certificate during the initial configuration.  SolarWinds recommends to replace the following certificate with a SSL certificate that is signed by a Certificate Authority.  If this is not possible and the warning messages about the certificate is not trusted needs to be avoid, export a copy of the self-signed certificate and installed as a Trusted Root Certificate Authority on each machine.

If the Web Console has only one binding, which is the recommended configuration, you can fix the issue by running the SolarWinds Configuration Wizard and reconfiguring the website. Clear the Skip website binding check box and select a valid certificate marked green. See Configure the Orion Web Console to use SSL for details.

The error The certificate assigned to https://webconsole.host:port binding can not be used for client authentication requires additional steps (see below).

If the Web Console has multiple bindings, run Active Diagnostics and follow the resolution steps for the returned error message.

1. Log on to the Orion server as an administrator.
2. Open Active Diagnostics, located by default in C:\Program Files (x86)\SolarWinds\Orion\ActiveDiagnostics.
3. Run individual tests.
4. Select Check site certificates.

The certificate assigned to https://webconsole.host:port binding is not found in the certificates store 

Install and assign an SSL certificate to the binding that failed. Refer to Add and assign certificate for web console for specific steps.

The certificate assigned to https://webconsole.host:port binding is invalid 

1. Log on to your main polling engine with local administrator privileges.
2. Run IIS Manager.
3. Expand Sites in the left pane.
4. Select the SolarWinds NetPerfMon site.
5. Click Bindings... in the right pane.
6. Select the binding and click Edit.
7. Select the SSL certificate and click View.
8. Read the issue description under Certificate information on the General tab.
   • Try to fix the issue yourself or select another valid certificate. You may need to acquire and install a new certificate if the current certificate is expired.
   • Navigate to the Certification Path tab and ensure there are no certificates with red marks there. Consult your web administrator on how to fix such issues.

 

The certificate assigned to https://webconsole.host:port binding is not a server certificate 

1. Log on to your main polling engine with local administrator privileges.
2. Run IIS Manager.
3. Expand Sites in the left pane.
4. Select the SolarWinds NetPerfMon site.
5. Click Bindings... in the right pane.
6. Select the binding and click Edit.
7. Select the SSL certificate and click View.
8. Navigate to the Details tab.
9. Scroll down and copy the Thumbprint value.
10. Run certlm.msc.
11. Right-click Certificates - Local Computer and select Find Certificates.
12. Paste the thumbprint value into the Contains: field.
13. Select SHA1 Hash in the Look in Field field.
14. Click Find Now.
15. Right-click the certificate in the search result pane and choose Properties.
16. Ensure that Server Authentication is listed for Certificate purposes, and is enabled as shown.

The certificate assigned to https://webconsole.host:port binding is revoked or parent certificates in the chain are revoked. 

1. Log on to your main polling engine with local administrator privileges.
2. Run IIS Manager.
3. Expand Sites in the left pane.
4. Select the SolarWinds NetPerfMon site.
5. Click Bindings... in the right pane.
6. Select the binding and click Edit.
7. Select the SSL certificate and click View.
8. Navigate to the Certification Path tab
9. Check and fix issues with certificates that are marked red. Consult your web administrator on how to fix such issues.

 

The certificate assigned to https://webconsole.host:port binding can not be used for client authentication. 

1. Log on to your main polling engine with local administrator privileges.
2. Run IIS Manager.
3. Expand Sites in the left pane.
4. Select the SolarWinds NetPerfMon site.
5. Click Bindings... in the right pane.
6. Select the binding and click Edit.
7. Select the SSL certificate and click View.
8. Navigate to the Details tab.
9. Scroll down and copy the Thumbprint value.
10. Run certlm.msc.
11. Right-click Certificates - Local Computer and select Find Certificates.
12. Paste the thumbprint value into the Contains: field.
13. Select SHA1 Hash in the Look in Field field.
14. Click Find Now.
15. Right-click the certificate in the search result pane and choose Properties.
16. Ensure that both Server Authentication and Client Authentication are listed and enabled in the Certificate purposes. You may need to acquire and install a new certificate if the current one does not have Client Authentication.

The certificate assigned to https://webconsole.host:port binding does not match 

Install and assign an SSL certificate to the binding that failed. The certificate (CN) field should match the server's FQDN or partially match FQDN using wildcards. Refer to Add and assign certificate for web console for specific steps.

The certificate assigned to https://webconsole.host:port binding does not have read permissions for the application user [User] to access the private key. 

1. Launch Orion Permission Checker (SolarWinds\Orion\OrionPermissionChecker.exe).

2. Click Repair.

You can also find the certificate key file and grant permissions manually.