Observability

Unable to Perform Network Discovery or Add Nodes Successfully on Additional Polling Engine (APE) in SolarWinds Platform 2025.2

This article provides information about an issue where Network Discovery or node addition fails when using APE in the SolarWinds Platform. This behavior may prevent the Discovery Wizard from completing or devices from being added to monitoring.

First published date

8/8/2025 4:03 PM

Last published date

8/11/2025 3:33 PM

Overview

When performing Network Discovery or adding a node from an APE, the operation may fail even when valid credentials are used.

Common symptoms include:

  • Network Discovery fails when initiated from an APE.
  • Node properties test fails when using valid WMI credentials.
  • The Main Polling Engine (MPE) cannot establish a secure WCF connection to the Core.BusinessLayer service on the APE during network discovery.
  • Error details in logs may include:
    • Certificate-based binding error:
       
      Core.WindowsClientOverTcp.ToOrionBusinessLayer.Cert
    • Configuration error related to exePath in at least one instance.
    • TransientApiProxyException caused by a CommunicationException with SocketException, for example:
       
      An existing connection was forcibly closed by the remote host.
    • Certificate Management Service (CMS) logs showing that the GetTrustedCertificates gRPC-Web call was blocked because certificate authentication did not pass authorization policy, resulting in HTTP 403 Forbidden:
       
      Request: POST https://localhost:17732/CertificateManagement.CertificateManagement/GetTrustedCertificates
Authorization failed. Fail() was explicitly called.
AuthenticationScheme: Certificate was challenged.
Request finished ... - 403

    • During node validation in Network Discovery, error shown: 

      Can't add in bulk

 

Technical background:
SolarWinds uses a built-in certificate infrastructure to secure communication between engines (MPE and APEs).

  • Each engine has its own SCA certificate and client certificates.

  • When one engine communicates with another (for example, adding a node to an APE from the MPE web console), the receiving engine must trust the sending engine’s certificate.

  • If the trusted issuer list is restricted and the SolarWinds CA is missing from the appropriate trusted stores, the connection will fail, impacting tasks like Network Discovery or node addition.

Product section

Hybrid Cloud Observability

Cause

The SendTrustedIssuerList registry key is set to 1 on the affected APE.

When enabled:

  • The client can only present certificates from issuers in the trusted issuer list.
  • If the correct SolarWinds CA is not in that list, the certificate is not presented or is rejected.
  • This causes the CMS to fail authentication/authorization and return an HTTP 403.
  • When CMS fails in this way, the MPE cannot communicate with the APE Core Business Layer, preventing network discovery or node addition.

Resolution

Option 1 – Disable the SendTrustedIssuerList registry key

  1. Open Registry Editor.
  2. Navigate to:
     
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL
  3. Set SendTrustedIssuerList to 0 (or delete the key if not required).

 

Option 2 – Keep it enabled but ensure SolarWinds CAs are in the system’s trusted stores

  1. Open MMC and add the Certificates snap-in for Computer Account → Local Computer.
  2. In Certificates (Local Computer):
    • Copy SolarWinds Root CA from Personal to Trusted Root Certification Authorities.
    • Copy SolarWinds SCA from Personal to Intermediate Certification Authorities.
  3. Ensure both certificates remain in Personal - CMS requires them there for proper functionality.

  4. Restart the SolarWinds services on both the Main Poller and all Additional Polling Engine to apply the changes.