ZTNA is authenticating but stops loading ... how to debug?

hi dirkkotte 
Thanks for reaching out, we checked error logs for your account. We found that your Identity provider creds are expired. Request you to please update the same. After updating creds, you can check if they are valid by doing Test connection

https://docs.sophos.com/central/ZTNA/startup/en-us/setup/IdentityProvider/index.html

You would also need to update your central Directory Sync settings, as we see from error logs , even those creds are expired

https://docs.sophos.com/central/customer/help/en-us/PeopleAndDevices/DirectoryService/SetUpSynchronizationWithActiveDirectory/index.html

cc Tejas Kashyap  

Thanks.
After updating creds it works again.
Is there an option to check the error logs by myself?
Would be great you generate an alert within ZTNA for this problem.

Hi Dirk, No, currently there is no way to view the identity provider logs. We are working on an alerting mechanism for users when the IdP credentials are about to expire. 

Hi,
I am able to open, Authenticate and use the agentless apps.

But the agent (from same device) say "Failed to create connection. Server certificate validation error gw.ztna.mydomain.de, due to: certificate verify failed (SSL routines) "  in "Sophos EndPoint self help / ZTNA"
Can't find some SSL or certificate-problems from within browser.

PS: The link behind the messages is dead:

Hi dirkkotte 
Thanks for sharing the information about the new error.

We see that ZTNA Gateway hasn't received the renewed cert as your ZTNA license was expired at time of renewal. Its a known issue, We will try to apply a workaround which would help unblock you, I will reach out once this is done so that you can verify 

Also the KB article link should redirect to https://support.sophos.com/support/s/article/KBA-000008084?language=en_US#link2 

Ok, thanks.
It is not a problem for me to add the certificate a second time ... should i do this?

No its not related to wild card cert you upload for the gateway. its internal certificate chain used for mutual TLS between gateway and endpoint

No its not related to wild card cert you upload for the gateway. its internal certificate chain used for mutual TLS between gateway and endpoint