The agent cannot establish trust. Prove which layer failed.
Certificate errors often get collapsed into “agent offline” or “enrollment failed.” Use these 24 checks to separate endpoint time, DNS, proxy, TLS, trust-chain, revocation, enrollment identity, and service failures before changing security controls or reinstalling the agent.
1. Preserve the failure
- Record the customer, site, endpoint, durable device identity, agent version, installer source, enrollment method, first-failure time, time zone, and business impact.
- Capture the exact error text, numeric code, service state, agent log excerpt, Windows event, failed destination, port, protocol, and certificate details before retrying.
- Determine whether the failure affects one endpoint, one image, one site, one proxy path, one agent version, one customer, or the entire vendor service.
- Preserve the change, deployment, token-issuance, certificate-rotation, proxy, firewall, inspection, and trust-store events around the first failure.
2. Prove time and path
- Verify the endpoint date, time, time zone, synchronization source, drift, and recent clock corrections from an independent source.
- Resolve the documented service hostname and confirm the endpoint reaches the intended address and port through its actual DNS, route, proxy, and firewall path.
- Compare the failing endpoint with a working peer on the same network for resolver, route, proxy, trust store, security policy, and agent-version differences.
- Check the vendor status page and test the same documented destination from another approved path to separate endpoint, site, and service failures.
3. Inspect TLS and trust
- Capture the leaf certificate subject, subject alternative names, issuer, serial, validity, thumbprint, key usage, signature algorithm, and complete presented chain.
- Confirm the requested hostname matches the certificate and that the chain terminates at a trusted root in the security context used by the agent service.
- Check certificate revocation and intermediate retrieval reachability without disabling validation, then retain the chain-build or revocation error.
- Review Schannel and agent events for protocol, cipher, signature, client-certificate, trust, name, expiry, or handshake alerts; do not infer cause from “TLS failed” alone.
4. Separate inspection and policy
- Determine whether a proxy, secure web gateway, TLS inspection appliance, VPN, EDR, or content filter substitutes certificates or changes the network path.
- Compare the presented issuer and thumbprint on failing and working paths; verify any enterprise inspection root is expected, current, and trusted in the agent service context.
- Review protocol and cryptographic policy for recent hardening changes, disabled legacy protocols, FIPS settings, cipher restrictions, or application-control events.
- Use only vendor-documented destinations and narrowly scoped, approved exceptions; do not disable TLS inspection, revocation, certificate validation, or endpoint protection globally.
5. Verify enrollment identity
- Confirm the enrollment token, installer, customer, site, region, tenant, and device identity belong together and are current, authorized, and not copied from another environment.
- Check whether the token, client certificate, device certificate, or registration was expired, revoked, rotated, exhausted, already consumed, or issued before a tenant change.
- Search for duplicate or stale device records created by cloning, reimaging, snapshot rollback, incomplete uninstall, or reuse of an installed agent in a golden image.
- Prefer the vendor-supported certificate renewal, registration repair, or clean re-enrollment workflow; preserve the old-to-new identity mapping and avoid orphaned privileged records.
6. Repair, validate, and close
- Correct the narrow verified dependency on one canary endpoint with an approved rollback, stop condition, actor, timestamp, output, and retained before-and-after evidence.
- Confirm a valid clock, expected path, trusted chain, unique enrollment identity, running service, fresh check-in, current inventory, and audit event after repair.
- Test monitoring, one bounded script, patch scan, and remote-support authorization separately so a heartbeat is not mistaken for full functional recovery.
- Reconcile the affected cohort into recovered, failed, duplicate, stale, revoked, excluded, unknown, or owned-exception states and record root cause, prevention, owner, and review date.
Definition of a completed certificate or enrollment repair
The incident is complete only when the endpoint uses the expected service name and network path, its clock and trust chain validate, its enrollment identity is current and unique, privileged functions work with audit evidence, every affected record is reconciled, and any temporary exception has a named owner and expiry.
Windows evidence references
These Microsoft references describe certificate and chain verification, Schannel troubleshooting settings, and Windows time synchronization. Use them to interpret evidence; follow the RMM vendor's current endpoint and enrollment documentation for platform-specific repairs.
RMM TLS, certificate, and enrollment questions
Why does an RMM agent fail TLS or certificate enrollment?
Common causes include incorrect system time, DNS or routing errors, TLS interception, missing or stale trust roots, certificate name mismatch, revocation-check failure, unsupported protocol policy, an expired token, or reuse of a cloned identity. Preserve the exact error and prove each layer before reinstalling.
Should I bypass certificate validation to restore an RMM agent?
No. Do not disable certificate validation, revocation checks, or TLS inspection globally merely to obtain a check-in. Identify the exact failing trust, identity, time, proxy, or policy dependency and use a vendor-supported, scoped repair.
What proves the repair worked?
Verify a valid endpoint clock, expected DNS and network path, a trusted certificate chain for the documented service name, a current unique enrollment identity, a fresh check-in, current inventory, and successful bounded function tests with audit evidence.