App Control: Package Generation Disabled Due To Match Error

[#1]

Environment

• App Control Server: 8.7.8, 8.8.6, 8.9.4 or Higher

Symptoms

• Package Generation Status under https://ServerAddress/InstallerVersions.php is disabled.
• GenerateWindowsInstaller value immediately reverts to 'false' when set to 'true'.
• ServerLog.bt9 includes messages like:

  (5032 PackageGeneration)SignatureQuery::ValidateCertificateOnFile: File[C:\Program Files (x86)\Bit9\Parity Server\hostpkg\ParityHostAgent.msi] did not match certificate Error[80096010]
  (5032 PackageGeneration)TestParityHostFile certificate validation failed: 0x80096010
  (5032 PackageGeneration) Deleted invalid host package file C:\Program Files (x86)\Bit9\Parity Server\hostpkg\ParityHostAgent.msi
  (5032 PackageGeneration) HostGroupStorage::GenerateWindowsPackages: Host files not correctly signed, turning off package generation

Cause

The digital signature of the file was unable to be verified, typically due to a modified hash value which, for security reasons, the file was deleted and Package Generation disabled.

Resolution

1. Verify Server Exclusions are added to any third-party security application (e.g. antivirus, real-time scanner, vulnerability scanner, etc).
2. Download the Agent Host Package Installer and re-upload to Console to replace missing files with known-good files.
3. If the issue persists, follow these troubleshooting steps.

Related Content

App Control: Antivirus Exclusions for Server
App Control: How To Upload Rule and Agent Packages to the Server
App Control: How to Troubleshoot Agent Package Generation Failures
Certificate and Trust Return Values - Win32 apps