Cannot enroll devices to Afaria via HTTPS relay

[Former Member]

Hello,

I have read a lot on these forums, about these problems, but cannot find the resolution.

Relay server seems to work, I have 5 RSOenablers (afaria,CA,IOS,Enrollment,Package). I also have configured RS on a relay server as a service, it looks like relaying is OK.

I have a problem enrolling any device (iOS or Android). with iOS I get to the profile installation, SCEP is managed OK, but when it should proceed it just hangs...the same is with Android. I open the Afaria app and enter the enrollment code. The enrollment code is accepted and the client starts to connect via https than hangs.

I have tried various things that I have found on the forum, and I am not sure what is correct and what is not. What certificates exactly do I need on Enrollment server (iphoneserver installation)? Is this the certificate with FQDN of Afaria server or FQDN of relay server? Which certificate do I have to use for "Device communication" page in Afaria? I am a little confused and am not sure how this should be installed...haven`t found any instructions.

I am sending you the logs of Android connection, I hope you can see something. I can see that there is an error at enrollment server connection (EV-Afaria-Aips) and the webpage returns 403 Forbidden...

I also get the error in Afaria logs:

XRS1391: Unable to establish SSL Connection with client at IP address 192.168.253.79.  EXPLANATION: A Client requested a SSL or HTTPS connection on this server, but the SSL handshake could not be completed. (Failing function: ASSLSocket::Init.  Return code: 5.)

I am attaching the logs.Probably this is something with certificates.

Thank you very much!

Rok

14052511-RelayServer.txt.zip

rsoe-Aips.txt.zip

[Former Member]

I have some new findings...The problem seems to be in a backend connection from RSoutbound enabler to the Afaria device communication port.

I can see this, as I change the port in the rsoe.config from my internal port (192.168...) to localhost, and that is seen in the error logs.

"The client" is in this case the RSoutbound enabler on the Afaria server.

Anyone?

Thanks,

R

[former_member201782]

Hello Rok,

Can you let us know your Afaria Version?

Looks like issue with SSL cert configuration. Have you validated your SSL configuration?

1. SSL cert need to be installed/configured on Relay Server

2. Same cert has to be imported into Personal and Trusted store of Afaria Server.

3. Reinstall Enrollment Server component and select this cert while setup.

4. See if you can launch Relay server status page with https without any certificate error.

Also let me know if you have checked 'Use https for Relay server connections' in Enrollment component page. If it is checked, then uncheck it and then try connecting.

Thanks,

Srikanth

[Former Member]

Hi Srikanth,

The Afaria version is 7.0 SP4 HF6

I have checked the SSL configuration, but I don`t see any errors.

I also isolated the problem, and it exists between RSoutbound enabler and Afaria server. As soon as I start RSoutbound enabler, the errors are displayed in Afaria log. Which certificate does RSoutbound enabler use to connect to Afaria server?

Everything is installed as you suggested. Maybe the problem is self signed certificate?

[former_member201782]

Hello Rok,

Make sure that all ports are open and you have enough permissions. Because 403 error means user doesn't have enough permissions.

RSOE doesn't use any certificate to connect to Afaria Server.

Problem could be the self signed certificate. What you can do is, you might have setup CA server right? You can generate a signed cert from CA server and then try to use it for enrollment and it will work.

I did the same for QA environment and it worked for me.

Thanks,

Srikanth

[former_member194958]

Hi Srikanth,

We've faced with the same problem.

"signed cert from CA" - you mean to create ssl?

Best regards,

Olga

[former_member201782]

Hello Olga,

Yes, you can generate self signed SSL from CA server and use it for Relay Server.

After you install this SSL cert, reinstall Enrolment Server and select this cert in the installation screens.

Hope this helps.

Thanks,

Srikanth