search

rafabu / SCOM-PKICertificateMP

This is for SCOM - System Center Operations Manager: The PKI Certificate Verification MP discovers PKI Certificates and Certificate Revocation Lists inside computers’ local certificate stores. It helps preventing service interruptions caused by invalid certificates by alerting when
GNU Lesser General Public License v3.0
20 stars 11 forks source link

Certificate discovery not working for some servers? #23

Open SkywalkerHogie opened 4 years ago

SkywalkerHogie commented 4 years ago

We have a "repository" server where we store all of our External certs in the Computer-->My store so we can configure alerting before they expire.

However this seems to have suddenly stopped working after we upgraded from SCOM 2012 R2 to 2016. The certificate store is detected and green, however none of the certificates are being "discovered'. I can run the task "List certificates" and they show via this task, but they're not being registered as "objects" therefore cannot be used in a dashboard or will not generate alerts.

Anything I can do to fix this? Moving them to another server seems to allow them to be discovered but this is undesirable.

SkywalkerHogie commented 4 years ago

Getting a bit closer to figuring out why ... event ID 10006 in the Operations Manager Event Log:

Discovery task has timed out.

Discovery name: SystemCenterCentral.Utilities.Certificates.LocalScriptProbe.RootCertificate.Discovery Instance name: Personal Computer Certificate Store Management group name: ****

Also some Power Shell script failed to run alerts:

Forced to terminate the following PowerShell script because it ran past the configured timeout 300 seconds. Script Name: SystemCenterCentral.Utilities.Certificates.Certificate_Verify_Script_V6.ps1 One or more workflows were affected by this. Workflow name: SystemCenterCentral.Utilities.Certificates.LocalScriptProbe.NonRootCertificate.DiscoveryInstance name: Personal Computer Certificate Store Instance ID: {F168E521-2C5D-BDBF-A117-32D55CBFEE7B}

I don't quite understand why the Power Shell discovery scripts are failing to return results and timing out ... this explains why deleted certs are not disappearing, new certs aren't being discovered, and perhaps why the state isn't changing.

Anyone able to assist?

SkywalkerHogie commented 4 years ago

I found that the discovery times out when there are too many certificates in the store. In this case there are 48 certificates ... the discovery script fails due to time out.

However, even after I cut the amount of certificates in the store in half, the discovery doesn't error ... but I don't see the certificates getting discovered in the OpsMgr portal.

charlez79 commented 4 years ago

I'm having this same issue on some servers.

BCornelissen commented 3 years ago

@SkywalkerHogie We would have to look into this SkywalkerHogie. Looks like a timeout like you say. We see some child script time-outs are set to 5 minutes. We could increase those to 15 minutes. I dont think it is an overridable parameter of the discovery currently.

kabawa commented 2 years ago

Any new update on this team ?, we are facing the same issues here @BCornelissen