App Control: Unable To Upgrade Agent: “Server Validation Failed, Mismatched Public Key Supplied”

[#1]

Environment

• App Control Server: 8.8.2 and Higher
• App Control Agent: 8.7.2 and Higher
• Microsoft Windows: All Supported Versions

Symptoms

Error when attempting to upgrade Agent via Console:

Agent upgrade: Failed to download upgrade package: https://ServerAddress/hostpkg/pkg.php?pkg=/ParityHostAgent.msi. WinHttpReceiveResponse: Server validation failed, mismatched public key supplied.
This error happened 2 time(s)"

Cause

The certificate bound to the Resource Download Location (RDL) is not currently Trusted in the Trusted Communication Certificate list.

Resolution

1. Verify the Resource Download Location (RDL) is accurate and contains the necessary files.
2. Verify the certificate used for the RDL matches a certificate listed as Trusted in the Console > System Configuration > Security > Trusted Communication Certificates.
   • If necessary, the current Agent Communication Certificate can be exported and used in IIS. Export the existing Agent Communication Certificate.
   • If necessary, a new certificate can be imported to the Trusted Communication Certificates list.
   • If the Trusted Communication Certificates list is missing, enable it.
3. If the certificate is already in the list:
   • Verify Agent(s) are Connected, Up to Date, and no Upgrade Pending.
   • Verify the Trust for the relevant certificate is enabled.
   • Rebuild the TrustedCertList.pem file.

Additional Notes

• If SSL Inspection, or some other network filtering/monitoring, is happening on Port 443 between the endpoint and the file download, this could cause difficulty in acquiring the file.
• If the issue persists, please open a case with Support and provide the Agent Historical Logs as well as a screenshot of the full page from the Console > System Configuration > Security

Related Content

App Control: How to Update Resource Download Location
App Control: How To Import a Trusted Communication Certificate
App Control: Agent Will Not Update CL Version When Agent Upgrade Is Pending
App Control: Server Certificate Missing from the Trusted Certificates List after Server Upgrade
App Control: How To Bind a New Certificate to Parity Web Console in IIS
App Control: Server Certificate Missing from the Trusted Certificates List after Server Upgrade
App Control: How to Enable the Trusted Communication Certificates Panel in Server 8.7