This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SafeGuard Client 5.50 Failed to Receive Policy/Key/Certificate, No Server Contact

Hi all,

I am new to SG and was assigned to manage SG encryption solution/troubleshoot issues. Unfortunately, there weren't any documentation/troubleshooting guide that I could find both on forum/internet/internal.

Can someone give me some pointers on how to troubleshoot Client/Server communication issues? This issue is happening to a selected few clients in WinXp and 7.

Basic Steps I've done:

- ran ClientPreinstall.msi, ran SGNClient.msi, ran SSL550.msi, all successfully, rebooted

- management server is responding to ping

- did http://server/sgnsrv, checkconnection, but there test button isn't not shown on the page

- ran sgnstate /l

Operating system : Windows XP
Product version : 5.50.8.13
POA type : SGN
Power On Authentication: n/a
WOL : n/a
Server name :
Logon mode : SGN UID
Client activation state: ENTERPRISE
Last data replication : 2014-02-13 15:31:11
Last policy received :
Return code : 0

Volume info :
Name Type Status Algorithm
--------------------------------------------------------
C: HDPART not encrypted n/a

- Client status says server not contacted yet, user state: SGN guest, Data packets prepared for transmission: stuck at 35.

I've read the best practice guide, but no troubleshooting steps were found in the guide, either. Why would this be happening only on a few machines?

Any help is much appreciated, Thank you!

This thread was automatically locked due to age.

0 ehsu over 10 years ago

- tried this: http://www.sophos.com/en-us/support/knowledgebase/1376/1380/112904.aspx
winhttp proxy is already at Direct Access (no proxy server).
- 5.50.8 client, 5.50.8 Client Configuration, Preinstall 5.50.8 are all in add/remove program entries
- checked C:\Documents and Settings\All Users\Application Data\Utimaco\SafeGuard Enterprise\LocalCache\transout\config\init.xml, it is displaing https://FQDN/SGNSRV/trans.asmx
- trying to test client connection according to this, but article has been removed: http://www.sophos.com/error/404.aspx?aspxerrorpath=/en-us/support/knowledgebase/107898.aspx
:47337
Cancel
Vote Up 0 Vote Down

Cancel
0 ehsu over 10 years ago

Found this Guide, currently going through it:
https://sophserv.sophos.com/repo_kb/109662/file/109662%20Analyzing%20Client%20Server%20communication.pdf
:47339
Cancel
Vote Up 0 Vote Down

Cancel
0 ehsu over 10 years ago

- Did the Invoke test successfully on the server via iis manager 6:
<WebService>OK</WebService><DBAuth>OK</DBAuth>
I've gone through the "Analysizing Client Server Communication" pdf. Erverything checks out except for the SSL cert, I have no idea what SSL was package in the ClientConfig.msi that got installed localled. As I search for the cert in the certificate store by the server common name, or the FQDN, none was found. I didn't think this was an issue because on my Win7 laptop, I also did not find a SSL issue from/to: for the management server, and my win7 laptop was able to communicate successfully.
Really need help on this, much appreciate if anyone can provide any other ideas, or need to open a case with Sophos support. Thank you!
:47341
Cancel
Vote Up 0 Vote Down

Cancel
0 ehsu over 10 years ago

anyone?
:47391
Cancel
Vote Up 0 Vote Down

Cancel
0 Funkey over 10 years ago

Hi Ehsu,
the SSL certificate itself is never part of the client configuration package it just defines how the client contacts the server.
Have you checked if you can reach the server using the address that was configured in the init.xml using SSL (without warning about a not trusted certificate) ?
It is important that the SSL certificate is available in the certstore of the machine (and not of the user) otherwise the communication will fail. If the SSL certificate was issued by your PKI it is sufficient if the CA certificate is trusted (and available in the correct store).
Instructions how to check that are available in KBA 110068 (chapter 7 Troubleshooting).
Hope that helps.
Cheers
F.
:47433
Cancel
Vote Up 0 Vote Down

Cancel
0 ehsu over 10 years ago

Thanks Funkey.
Will look into it.
:47465
Cancel
Vote Up 0 Vote Down

Cancel
0 ehsu over 10 years ago

I've checked the server SSL Cert (issued by VeriSign Class 3 Secure Server CA - G3) isn't being found in the local Trusted Root CA for ones that can establishes communication and as well as for those who cannot establish communication.
Any other ideas? I will open a support case for this in the mean time.
:47563
Cancel
Vote Up 0 Vote Down

Cancel
0 ehsu over 10 years ago

Contacted support and opened a case for this.
Ran through standard troubleshooting steps and everything was verified successfully. However, the agent is still not able to communication with the server.
I've collected SDUlog.zip from running SDU utility and sending the log to support for analysis.
:47647
Cancel
Vote Up 0 Vote Down

Cancel