How to configure WinRM for HTTPS access? (4327838)

The WinRM HTTPS connection is unsuccessful.

The following errors may be found in the alarm message:

>> Failure: Cannot establish connection to hostname.example.com: WinRM request to https://hostname.example.com:5986/wsman failed:   [Caused by: ConnectException <Connection refused: connect>]

>> Failure: Cannot establish connection to hostname.example.com: WinRM request to https://hostname.example.com:5986/wsman failed: [Caused by: SSLHandshakeException <PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target>]

How to configure WinRM connections for HTTPS access if not possible to set the AllowUnencrypted property of the WinRM service to true?

CAUSE 1

The remote host doesn't have a WinRM HTTPS listener for port 5986

CAUSE 2

There's firewall interference between the FglAM (Agent Manager) and the target host over port 5986

CAUSE 3

The Agent Manager's truststore is missing the root or intermediate certificates needed to verify the SSL certificate presented by the server.

Configuring WinRM HTTPS access on the target machine

A valid server authentication certificate must be installed on the target machine in order to enable HTTPS.

To enable HTTPS access:

1. Open a command prompt window on the target machine.
2. Issue the following command:

   winrm quickconfig -transport:https

   The above command enabled HTTPS access using the certificate installed on the host. 

   If you want to use a different certificate, you can create a new HTTPS listener and specify the certificate:

   winrm create winrm/config/listener?Address=*+Transport=HTTPS @{Hostname="<host>";CertificateThumbprint="<thumbprint>"}

   Where:

   • host is the host name, as it appears in the certificate Subject CN.
   • thumbprint is the certificate thumbprint, with spaces removed.

Add certificates to the Agent Manager's trust keystore

In environments where an in-house certificate granting authority (CA) is in use, the CA’s certificate must be added to the Agent Manager's truststore.

To add the certificate:

1. Ensure that the Agent Manager is running.
2. Launch a command shell on the Agent Manager machine, and navigate to the <fglam_home>/bin directory.
3. Issue the following command:

   fglam --add-certificate alias=/path/to/saved.ca.certificate

4. To list the certificates currently in the truststore:

   fglam --list-certificates

Notes:

• Please refer to the latest version of the Foglight Agent Manager User Guide for specific details on Configuring Windows Remote Management (WinRM) including configurations for Negotiate (Kerberos) and Basic authentication mechanisms.
• For additional troubleshooting steps for WinRM connections refer to Troubleshooting WinRM host monitoring (4217338).

Firewall interference

For issues releated to firewall intereference, the only possible workaround would be to allow TCP traffic over port 5986 from the FglAM to the target host.

The certificate presented by the WinRM service can be verified using the keytool command:

[FGLAM_HOME]/jre/[VERSION]/jre/bin/keytool -printcert -sslserver hostname:5986

To retrieve the certificate chain in PEM format, add the -rfc option to the command:

[FGLAM_HOME]/jre/[VERSION]/jre/bin/keytool -printcert -sslserver hostname:5986 -rfc