Certificate validation errors
Product: Agilent Connected Instrument Device (CID) for OpenLab CDS Audience: Agilent Support, IT/network administrators Support reference: Network / firewall configuration
The diagnostic procedures on this page are intended for IT administrators familiar with Linux commands. Incorrect use of the underlying tools can misconfigure the CID and render it inoperable. Proceed only if you are comfortable working in a Linux environment.
Symptom
An operation fails with a certificate-related error even though the CID's basic
network checks pass. For example, Recent activity might show
Error validating IoT device certificate: <error-info>.
A certificate-related message does not identify the cause by itself. A corporate or internal issuer can be consistent with TLS inspection or certificate substitution, but it does not by itself explain why the operation failed.
Cause
The message might relate to the CID's device certificate, a certificate presented by an OpenLab Server, or the external network path. The next step depends on the failed operation. Network reachability and accurate time must also be confirmed before investigating certificates.
Confirm this is the right document
| Result | Next step |
|---|---|
| The CID reports a certificate-related error after the basic network checks pass | Continue with Diagnostic steps. |
| DNS lookup or TCP port 443 fails | See Verify CID internet connectivity. |
| The CID Connectivity Tester reports an NTP failure | See NTP time synchronization failure. |
| The TLS connection closes without returning a certificate | See TLS handshake failure. |
Affected services
The effect depends on the operation that failed. A certificate-related error can prevent a CID from registering with an OpenLab Server or communicating with CID Hub. When communication with CID Hub is interrupted, local CDS acquisition and processing continue.
Prerequisites
- You can open the CID Connectivity Tester.
- You can review Recent activity for the affected CID.
- You know whether the failed operation was connecting to an OpenLab Server or an internet endpoint.
Diagnostic steps
Step 1. Confirm network and time connectivity
Run the CID Connectivity Tester for the affected endpoint. If the endpoint is not in the predefined list, enter its URL as a custom endpoint.
| Result | Next step |
|---|---|
| DNS lookup or TCP port 443 fails | Follow the matching result in Verify CID internet connectivity. |
| The NTP test fails | Follow NTP time synchronization failure. |
| The network and NTP tests pass, but the certificate error remains | Continue with Step 2. Identify the affected connection. |
Step 2. Identify the affected connection
Use the failed operation and Recent activity message to identify the destination.
| Affected connection | Next step |
|---|---|
| OpenLab Server or OpenLab ECM | Continue with OpenLab Server certificate. |
Recent activity shows Error validating IoT device certificate, or the operation was connecting to CID Hub or another required internet endpoint | Continue with CID Hub or internet connection. |
| The destination is unclear | Record the evidence in Step 3. Preserve the diagnostic evidence, then contact Agilent Support. |
Step 3. Preserve the diagnostic evidence
Record the following information before changing the network configuration:
- The affected operation and endpoint.
- The complete certificate error and its timestamp.
- The CID Connectivity Tester results for that endpoint and for NTP.
- The relevant Recent activity entries.
Provide this information to Agilent Support and, when the external network path is involved, your network security team.
Resolution
OpenLab Server certificate
If the OpenLab Server or OpenLab ECM certificate was issued by an internal, corporate, or self-signed certificate authority (CA), import the issuing root and intermediate CAs into CID Hub. For a standalone self-signed certificate, import the server certificate itself. See Use corporate certificates.
After the certificates synchronize to the CID, retry the failed operation.
CID Hub or internet connection
Correct any network or time failure identified by the CID Connectivity Tester. If those checks pass and the certificate error remains, provide the evidence from Step 3 to Agilent Support and your network security team. Ask the network team to confirm whether a security appliance changes the certificate presented for the affected endpoint and to verify the connection against the Internet requirements.
Related documents
Last updated: