Basic troubleshooting for Server Identity Validation

The following steps provide some basic troubleshooting guidelines to help identify TLS connection failures between only EP servers or between EP servers and external servers when Server Identity Validation is enabled:

• Disable the Server Identity Validation setting and check if the TLS connections with external servers are working.

• Examine the EPM/MPP event logs, alarms, and EPM/MPP debug logs to check if the server identity validation failure has caused any issue.

• If you see the following error message when adding an MPP, Auxiliary EPM, or LDAP server connection:

  Cannot verify identity of server(< hostname>) as there is no valid DNS Name in the SubjectAltNames nor matching Common Name of the server certificate

  It means the server identity certificate did not pass the server identity validation check. That is, the Common Name of the certificate is not valid, and there is no valid DNS name in the SubjectAltNames extension of the certificate.

• Use the following openssl command to connect to the server to receive and examine the server certificate:

  openssl s_client -showcerts -connect <server hostname>:<port>

• Monitor the traffic between the Experience Portal system and the external server. For example, use tcpdump and examine the certificate the server sent during the TLS handshake.