How to configure WinRM HTTPS using a certificate? (4327838)

The WinRM HTTPS connection is unsuccessful.

The following errors can be found in the alarm message:

>> Failure: Cannot establish connection to hostname.example.com: WinRM request to https://hostname.example.com:5986/wsman failed:   [Caused by: ConnectException <Connection refused: connect>]

CAUSE 1

The remote host doesn't have a WinRM HTTPS listener for port 5986

CAUSE 2

There's firewall interference between the FglAM (Agent Manager) and the target host over port 5986

Workaround1: Configuring WinRM HTTPS access on the target machine

A valid server authentication certificate must be installed on the target machine in order to enable HTTPS.

To enable HTTPS access:

1. Open a command prompt window on the target machine.
2. Issue the following command:

   winrm quickconfig -transport:https

   The above command enabled HTTPS access using the certificate installed on the host. 

   If you want to use a different certificate, you can create a new HTTPS listener and specify the certificate:

   winrm create winrm/config/listener?Address=*+Transport=HTTPS @{Hostname="<host>";CertificateThumbprint="<thumbprint>"}

   Where:

   • host is the host name, as it appears in the certificate Subject CN.
   • thumbprint is the certificate thumbprint, with spaces removed.

Add certificates to the Agent Manager's trust keystore

In environments where an in-house certificate granting authority (CA) is in use, the CA’s certificate must be added to the Agent Manager's truststore.

To add the certificate:

1. Ensure that the Agent Manager is running.
2. Launch a command shell on the Agent Manager machine, and navigate to the <fglam_home>/bin directory.
3. Issue the following command:

   fglam --add-certificate alias=/path/to/saved.ca.certificate

Notes:

• Please refer to the latest version of the Foglight Agent Manager user guide for specific details on Configuring Windows Remote Management (WinRM) including configurations for Negotiate (Kerberos) and Basic authentication mechanisms.
• For additional troubleshooting steps for WinRM connections refer to Troubleshooting WinRM host monitoring (4217338).

Workaround 2: Firewall interference

For issues releated to firewall intereference, the only possible workaround would be to allow TCP traffic over port 5986 from the FglAM to the target host.

The attached PDF document "Configure Winrm HTTPS.pdf" includes example steps to import a new certificate and to add thumbprint of new certificate to the WinRM HTTPS listener.

After completing the process:

• Data collection is working
 
• Agent logs show WinRM connection is established: Established a WinRMConnection connection to