Common Errors in the JAMFSoftwareServer.log File

2021-07-31 12:47:10,023 [ERROR] [-Pki-Pool-1] [ertificatePayloadInjector] - Problem requesting certificate from ADCS
com.jamfsoftware.jss.core.service.certapi.CertificateRequestServiceException: Problem requesting certificate from ADCS

Caused by:

javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

GUI:

Remains pending or fails with: "Failed to inject certificates into the profile".

Solution:

Check the Jamf AD CS Connector server certificate in IIS and the Jamf Pro PKI settings. If a load balancer/reverse proxy is in place, check the server certificate on the load balancer/reverse proxy.

2021-07-31 14:45:09,581 [ERROR] [-Pki-Pool-1] [ertificatePayloadInjector] - Problem requesting certificate from ADCS
com.jamfsoftware.jss.core.service.certapi.CertificateRequestServiceException: Problem requesting certificate from ADCS

Caused by:

com.jamfsoftware.pki.adcs.exception.AdcsConnectorCertificateNotIssuedException: CR_DISP_DENIED: Request denied

GUI:

Remains pending or fails with: "Failed to inject certificates into the profile"

Solution:

Check the template or variables.

2021-07-31 15:37:47,755 [ERROR] [-Pki-Pool-1] [ertificatePayloadInjector] - Problem requesting certificate from ADCS
com.jamfsoftware.jss.core.service.certapi.CertificateRequestServiceException: Problem requesting certificate from ADCS

Caused by:

com.jamfsoftware.pki.adcs.exception.AdcsConnectorCertificateNotIssuedException: INTERNAL_ERROR: System.ArgumentException - CCertRequest::Submit: The parameter is incorrect. 0x80070057 (WIN32: 87 ERROR_INVALID_PARAMETER)

GUI:

Remains pending or fails with: "Failed to inject certificates into the profile"

Solution:

Check CA name in the PKI Certificates settings in Jamf Pro.

2021-07-31 15:42:47,394 [ERROR] [-Pki-Pool-2] [ertificateInjectorService] - Failed to issue certificate for command c6fef8da-c73c-4068-a411-73739815ffad and payload E096CC55-C0D4-4202-91EF-6D84545D8CD0 improperly specified input name: 000000000000
java.lang.IllegalArgumentException: improperly specified input name: 000000000000

Caused by:

java.io.IOException: Incorrect AVA format

GUI:

Remains pending or fails with: "Failed to inject certificates into the profile"

Solution:

Missing CN= in format

2021-07-31 15:51:21,554 [ERROR] [-Pki-Pool-1] [ertificatePayloadInjector] - Problem requesting certificate from ADCS
com.jamfsoftware.jss.core.service.certapi.CertificateRequestServiceException: Problem requesting certificate from ADCS

Caused by:

com.jamfsoftware.pki.adcs.exception.AdcsConnectorCertificateNotIssuedException: INTERNAL_ERROR: System.Runtime.InteropServices.COMException - CCertRequest::Submit: The RPC server is unavailable. 0x800706ba (WIN32: 1722 RPC_S_SERVER_UNAVAILABLE)

GUI:

Remains pending or fails with: "Failed to inject certificates into the profile"

Solution:

Check the CA's Fully Qualified Domain Name (FQDN) in the PKI Certificates settings in Jamf Pro or the firewall settings.

2021-07-31 16:21:09,559 [ERROR] [-Pki-Pool-2] [ertificatePayloadInjector] - Problem requesting certificate from ADCS
com.jamfsoftware.jss.core.service.certapi.CertificateRequestServiceException: Problem requesting certificate from ADCS

Caused by:

java.net.UnknownHostException: [myadcs.mydomain.devBAD]: Name or service not known

GUI:

Remains pending or fails with: "Failed to inject certificates into the profile"

Solution:

Check the FQDN of the Jamf AD CS Connector.

2021-08-01 13:25:38,357 [ERROR] [-Pki-Pool-1] [ertificatePayloadInjector] - Problem requesting certificate from ADCS
com.jamfsoftware.jss.core.service.certapi.CertificateRequestServiceException: Problem requesting certificate from ADCS

Caused by:

org.apache.http.conn.ConnectTimeoutException: Connect to [myadcs.mydomain.com:443 [myadcs.mydomain.com/10.0.1.3] failed: connect timed out

GUI:

Remains pending or fails with: "Failed to inject certificates into the profile"

Solution:

Check firewalls.

2021-08-01 14:00:54,234 [ERROR] [-Pki-Pool-7] [ertificatePayloadInjector] - Problem requesting certificate from ADCS
com.jamfsoftware.jss.core.service.certapi.CertificateRequestServiceException: Problem requesting certificate from ADCS

Caused by:

org.springframework.web.client.HttpClientErrorException$Unauthorized: 401 Unauthorized: [<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">]

GUI:

Remains pending or fails with: "Failed to inject certificates into the profile"

Solution:

Check the client certificate.

2021-08-01 14:00:54,234 [ERROR] [-Pki-Pool-7] [ertificatePayloadInjector] - Problem requesting certificate from ADCS
com.jamfsoftware.jss.core.service.certapi.CertificateRequestServiceException: Problem requesting certificate from ADCS

Caused by:

org.springframework.web.client.HttpClientErrorException: 403 Forbidden

GUI:

Remains pending or fails with: "Failed to inject certificates into the profile"

Solution:

Check the trusted root CA on the Jamf AD CS Connector or client certificate. For more information, see the following Microsoft documentation: Error when you open an IIS webpage: 403.7 Forbidden: Client certificate required

2021-08-01 14:00:54,234 [ERROR] [-Pki-Pool-7] [ertificatePayloadInjector] - Problem requesting certificate from ADCS
com.jamfsoftware.jss.core.service.certapi.CertificateRequestServiceException: Problem requesting certificate from ADCS

Caused by:

org.springframework.web.client.ResourceAccessException: I/O error on POST request for "https://ADCSConnector.server.here/api/v1/certificate/request": Connection reset; nested exception is java.net.SocketException: Connection reset

Example error in the IIS Logs:

2024-01-25 21:36:06 10.19.3.42 POST /api/v1/certificate/request - 443 - 18.224.191.224 Java-SDK - 403 7 64 1

GUI:

Remains pending or fails with: "Failed to inject certificates into the profile"

Solution:

This error occurs when the Jamf AD CS Connector server is running Windows Server 2022 and Software Updates may have updated IIS to default to the TLS 1.3 protocol.

In IIS Manager, edit the Site Binding, select the Disable TLS 1.3 over TCP checkbox, and then restart the web services.

Note:

You can also disable TLS 1.3 over TCP using the registry or third-party tools.

2024-08-08 15:24:25,741 [ERROR] [-Pki-Pool-1] [ertificatePayloadInjector] - Failed to get pending PKI payload certificate
com.jamfsoftware.jss.core.service.certapi.CertificateRequestServiceException: Request has failed with status INTERNAL_ERROR. Initiate another request in the future

Caused by:

com.jamfsoftware.pki.adcs.exception.AdcsConnectorCertificateNotIssuedException: INTERNAL_ERROR: System.NullReferenceException - Object reference not set to an instance of an object.

GUI:

Remains pending or fails with: "Failed to inject certificates into the profile"

Solution:

If you are using Jamf Pro 11.9.0 or later and Jamf AD CS Connector 1.0.0, upgrade the Jamf AD CS Connector version to 1.1.0 or later.

2022-04-07 11:18:41,130 [ERROR] [-Pki-Pool-2] [ertificatePayloadInjector] - Problem requesting certificate from ADCS
com.jamfsoftware.jss.core.service.certapi.CertificateRequestServiceException: Problem requesting certificate from ADCS

Caused by:

com.jamfsoftware.pki.adcs.exception.AdcsConnectorCertificateNotIssuedException: CR_DISP_DENIED: Request denied

GUI:

Remains pending or fails with: "Failed to inject certificates into the profile"

Solution:

This error can occur for multiple reasons:

• You are using a variable that is mapped to something like $USERNAME and the Username is empty on the computer record.

• The Certificate Template has 'Archive subject's encryption private key' enabled under Request Handling.

• "Issue and Manage Certificates" permissions haven't been granted to the Jamf AD CS Connector on the CA. Authenticated Users should have "Read" Permissions on the CA.

• The Jamf AD CS Connector needs the "Enroll" Permissions on the Certificate Template. Authenticated Users should have "Read" Permissions on the Certificate Template.

• The Template Name is incorrect in the Configuration Profile settings. You can verify the Template Name by doing the following:

  1. On the CA Server, open Server Manager and then the Certificate Authority.

  2. In certsrv, right-click the Certificate Templates and select Manage.

  3. In Certificate Templates, right-click the Certificate Template you are using and select Properties.

  4. In the Properties, you will see 'Template display name:' and 'Template name:'. The Template Name must be entered in the configuration profile settings in Jamf Pro.

2024-09-03 13:59:19,918 [ERROR] [Pki-Pool-45] [ertificatePayloadInjector] - Failed to get PKI payload certificate
com.jamfsoftware.jss.core.service.certapi.CertificateRequestServiceException: Problem requesting certificate from ADCS

Caused by:

org.springframework.web.client.HttpServerErrorException$ServiceUnavailable: 503 Service Unavailable: "<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><EOL><EOL><HTML><HEAD><TITLE>Service Unavailable</TITLE><EOL><EOL><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><EOL><EOL><BODY><h2>Service Unavailable</h2><EOL><EOL><hr><p>HTTP Error 503. The service is unavailable.</p><EOL><EOL></BODY></HTML><EOL><EOL>"

GUI:

Remains pending or fails with: "Failed to inject certificates into the profile"

Solution:

If the AdcsProxyPool is disabled, the AdcsProxy site will return an HTTP 503 response. Open Event Viewer and navigate to Windows Logs > System to determine the error message and Event ID.

• Event ID 5021 —The identity of application pool %1 is invalid. The username or password that is specified for the identity may be incorrect, or the user may not have batch logon rights. To fix this issue, re-enter the username and password for the domain service account used as the identity for the AdcsProxyPool application pool. Then restart the IIS service. For more information, see the following documentation from Microsoft: Event ID 5021 — IIS Application Pool Availability
• Event ID 5057 —Application pool %1 has been disabled. Windows Process Activation Service (WAS) did not create a worker process to serve the application pool because the application pool identity is invalid. To fix this issue, ensure the domain service account has been added to the computer's local `IIS_USRS` group. For more information, see the following documentation from Microsoft: Event ID 5057 — IIS Application Pool Availability
• Event ID 5059 —
  Application pool %1 has been disabled. Windows Process Activation Service (WAS) encountered a failure when it started a worker process to serve the application pool. To fix this issue, do the following:

  1. Ensure the account used as application pool identity is not locked.

  2. Reset the password of the application pool identity account in case it is expired.

  3. Switch from built-in account to domain account for application pool identity.

  4. Use another domain account as application pool identity.

  5. Give "Full control" to application pool identity account on shared data and configuration folders.

  6. Give "Log on as Batch Job" permission to the application pool identity account.

  7. Add the application pool identity account to IIS_USRS group.

  8. Check account information in applicationHost.config for possible typos.

  9. Recreate application pools, websites, and shared configuration (if used).

  10. Ensure you are using the same encryption provider (IISWASOnlyCngProvider or IISCngProvider) in applicationHost.config.

  11. Change the application pool process model from LogonBatch to LogonService.

  12. If a shared configuration is set up in IIS, use the same IISWASKey.

  For more information, see the following documentation from Microsoft: Event ID 5059 — IIS Application Pool Availability

2021-08-01 14:00:54,234 [ERROR] [-Pki-Pool-7] [ertificatePayloadInjector] - Problem requesting certificate from ADCS
com.jamfsoftware.jss.core.service.certapi.CertificateRequestServiceException: Problem requesting certificate from ADCS

Caused by:

com.jamfsoftware.pki.adcs.exception.AdcsConnectorCertificateNotIssuedException: INTERNAL_ERROR: System.Runtime.InteropServices.COMException - CCertRequest::Submit: An internal error occurred. 0x80090020 (-2146893792 NTE_FAIL)

GUI:

Remains pending or fails with: "Failed to inject certificates into the profile"

Solution:

If the Issuing CA's certificate expiration date comes before the expiration date of the certificates you are trying to deploy, certificate deployments will fail and this error will display in the Server Logs. For example, if the Certificate Template being used in the request has a validity period of 3 years and the Issuing CA's certificate expires before that, it cannot issue that certificate because it would have a longer validity period than the Issuing CA's would be valid.

2021-08-01 14:00:54,234 [ERROR] [-Pki-Pool-7] [ertificatePayloadInjector] - Problem requesting certificate from ADCS
com.jamfsoftware.jss.core.service.certapi.CertificateRequestServiceException: Problem requesting certificate from ADCS

Caused by:

org.springframework.web.client.HttpServerErrorException$InternalServerError: 500 Internal Server Error:

GUI:

Remains pending or fails with: "Failed to inject certificates into the profile"

Solution:

This error is usually caused by having a .NET Framework version earlier than 4.8 and Jamf AD CS Connector 1.1.0 installed. Update the .NET Framework to 4.8 or later.

If the issue is not the .NET Framework, navigate to the following URL using a browser on the Jamf AD CS Connector server: https://FQDN/api/v1/certificate/request

Note:

Make sure to replace FQDN with the actual Domain Name being used for the Jamf AD CS Connector.

On that page, you should see the 500 error shown in the header and an HResult code toward the bottom. Locate the HResult code in the following Microsoft documentation: HTTP Error 500.0 - Internal Server Error error when you open an IIS webpage