NMC: Installation Fails with Error "Unable to Verify Authentication Server's Hostname or Port"

• The NetWorker Management Console (NMC) installation fails on a Windows host with an Authentication failure message.

• The NMC server is installed on a Windows host separate from the NetWorker server.
• The NetWorker authentication service is up and running.
• Port 9090 is open.

nsrports -t NetWorker_ServerName -p 9090

The NMC installation negotiates with the NetWorker authentication service over TLS earlier than version 1.2.

Perform the following on the NetWorker server:

1. Make a backup copy of:

C:\Program Files\EMC NetWorker\nsr\authc-server\tomcat\conf\server.xml.

2. Edit the server.xml file and look for the string.
   NetWorker 19.12 (and Earlier) Example:

sslEnabledProtocols="TLSv1.2"

SSLHostConfig protocols="TLSv1.2"

"TLSv1.2, TLSv1.1, TLSv1"

3. Save the changes to the file.
4. Restart the NetWorker service.

net stop nsrd
net start nsrd

5. Install NetWorker and NMC on the NMC server. This time the prompt to install the certificate should appear.
   
   NOTE: If you still do not see the option to install the certificate, the issue may be due to a mismatch between the Ciphers advertised by the Authc server OS and the ones used by your NetWorker version's Authc Ciphers. See: NetWorker: NMC server install fails on Windows Host "Unable to verify Authentication Server's Hostame and or Port".
6. Add the certificate to the Root Trusted certificate list.
   1. Click View Certificate.
   2. From the Certificate, click Install Certificate.
   3. Select Local Machine and click Next.
   4. Select Place all certificates in the following store, then click Browse.
   5. Select Trusted Root Certification Authorities, then click OK.
   6. On the Certificate Install Wizard, click Next.
   7. Click Finish.
   8. You should receive a pop-up stating "The import was successful," click OK.
   9. From the Certificate window, click OK.
   10. From the Security Alert window, click Yes.
7. Continue until the installation completes.

After the installation finishes, revert to the original copy of server.xml. A NetWorker service restart is required for the changes to take effect.

Related Article: NMC install fails on Windows Host "Unable to verify Authentication Server's Hostname and/or Port"

TLS validation:

The following can be run in a PowerShell prompt on the NMC server, replace the AUTHC_SERVERNAME with your AUTHC server address.

$server = "AUTHC_SERVERNAME"
$port   = 9090

$tcp = [System.Net.Sockets.TcpClient]::new()
$tcp.Connect($server, $port)
$ssl = [System.Net.Security.SslStream]::new(
    $tcp.GetStream(),
    $false,
    { param($sender,$cert,$chain,$errors) $true }
)

try {
    $ssl.AuthenticateAsClient($server)
    "=== Protocol ==="
    $ssl.SslProtocol
    "=== Cipher ==="
    "$($ssl.CipherAlgorithm) ($($ssl.CipherStrength)-bit)"
    "=== Certificate Chain (PEM) ==="
    # Build the chain from the remote leaf certificate
    $remoteCert = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new($ssl.RemoteCertificate)
    $xchain = [System.Security.Cryptography.X509Certificates.X509Chain]::new()
    $null = $xchain.Build($remoteCert)
    $i = 0
    foreach ($elem in $xchain.ChainElements) {
        $i++
        $c = $elem.Certificate
        "----- Certificate $i -----"
        "Subject  : $($c.Subject)"
        "Issuer   : $($c.Issuer)"
        "NotBefore: $($c.NotBefore)"
        "NotAfter : $($c.NotAfter)"
        ""
    }
}
finally {
    $ssl.Dispose()
    $tcp.Dispose()
}

Example:

PS C:\Users\Administrator.NETWORKER> $server = "win-srvr02.networker.lan"
PS C:\Users\Administrator.NETWORKER> $port   = 9090
PS C:\Users\Administrator.NETWORKER>
PS C:\Users\Administrator.NETWORKER> $tcp = [System.Net.Sockets.TcpClient]::new()
PS C:\Users\Administrator.NETWORKER> $tcp.Connect($server, $port)
PS C:\Users\Administrator.NETWORKER> $ssl = [System.Net.Security.SslStream]::new(
>>     $tcp.GetStream(),
>>     $false,
>>     { param($sender,$cert,$chain,$errors) $true }
>> )
PS C:\Users\Administrator.NETWORKER>
PS C:\Users\Administrator.NETWORKER> try {
>>     $ssl.AuthenticateAsClient($server)
>>     "=== Protocol ==="
>>     $ssl.SslProtocol
>>     "=== Cipher ==="
>>     "$($ssl.CipherAlgorithm) ($($ssl.CipherStrength)-bit)"
>>     "=== Certificate Chain (PEM) ==="
>>     # Build the chain from the remote leaf certificate
>>     $remoteCert = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new($ssl.RemoteCertificate)
>>     $xchain = [System.Security.Cryptography.X509Certificates.X509Chain]::new()
>>     $null = $xchain.Build($remoteCert)
>>     $i = 0
>>     foreach ($elem in $xchain.ChainElements) {
>>         $i++
>>         $c = $elem.Certificate
>>         "----- Certificate $i -----"
>>         "Subject  : $($c.Subject)"
>>         "Issuer   : $($c.Issuer)"
>>         "NotBefore: $($c.NotBefore)"
>>         "NotAfter : $($c.NotAfter)"
>>         ""
>>     }
>> }
>> finally {
>>     $ssl.Dispose()
>>     $tcp.Dispose()
>> }
=== Protocol ===
Tls12
=== Cipher ===
Aes256 (256-bit)
=== Certificate Chain (PEM) ===
----- Certificate 1 -----
Subject  : CN=WIN-SRVR02.networker.lan, OU=NetWorker, O=DELL, L=Round Rock, S=TX, C=US
Issuer   : CN=WIN-SRVR02.networker.lan, OU=NetWorker, O=DELL, L=Round Rock, S=TX, C=US
NotBefore: 12/12/2025 15:16:03
NotAfter : 12/06/2050 15:16:03

This output shows that the TLS protocol negotiated is TLSv1.2, and that the AUTHC server is using a valid self-signed certificate.