Troubleshooting

Most problems show their reason on the page where they happened. Start there, then look below.

Where to look

  • Certificates page: why an issue or renewal failed, and which hosts failed to receive a certificate.
  • A host's page > Agent status: an agent's last check-in and last error.
  • Hosts list > Agent column: each agent's version and last check-in, with a badge if it needs updating or reinstalling (badges explained).
  • Settings > License: the license server's last message.
  • Setup logs: C:\ProgramData\NeverLapse\logs (Windows). On Linux: journalctl -u neverlapse-cert -u neverlapse-cert-web and /var/lib/neverlapse-cert-server/Logs.
  • Services on the NeverLapse server: NeverLapse Cert and NeverLapse Cert Web must be running (on Linux: the systemd services neverlapse-cert and neverlapse-cert-web).
  • NeverLapse services stopped after a reboot (versions before 1.5.3, when SQL Server Express started slowly): start NeverLapse Cert and NeverLapse Cert Web, or update to 1.5.3 -- since 1.5.3 they wait for the database and start on their own. The NeverLapse log shows "still waiting for the database" while they wait; Windows' System event log shows them "terminated unexpectedly" once, followed by "Restart the service": that's the planned restart.

Installation

  • Setup stops while installing prerequisites: the message gives the reason, and nothing has been half-installed. The full log is in C:\ProgramData\NeverLapse\logs.
  • SQL Server Express setup fails (exit code -2068052413 / 1603) on a server with SentinelOne, CrowdStrike or similar: security software is interfering with Windows Installer. See Security software.
  • SQL Server Express download fails: the server can't reach Microsoft. Put SQLEXPR_x64_ENU.exe next to the installer and run it again.
  • "Database not found" with an existing SQL Server: check the name; Setup lists the databases that do exist. Or let Setup create it.
  • Windows Authentication to SQL fails: the service account (for Local System, the computer account DOMAIN\SERVER$) needs a SQL login with access to the database. SQL Server Authentication is simpler.

The console

  • Browser says the connection isn't private: the self-signed certificate from Setup. Issue a real one for the console's name and pick it under Web server certificate.
  • Can't reach the console: check the NeverLapse Cert Web service is running, the port (Settings > Server address) and that Windows Firewall or a network firewall allows it.
  • Locked out: after 8 wrong passwords an account is locked for 10 minutes. Another user can reset its password under Users. Forgot password? on the sign-in page works if email is set up.

Licensing

  • The key isn't accepted: paste the whole key from the email (line breaks are fine). "A newer key was issued" means a new key was made in your account: use that one.
  • "This license is already in use on ...": a license is for one server. Remove it from the other server, or Release it in your account.
  • Can't reach the license server: the server needs outbound HTTPS to neverlapse.live. NeverLapse keeps working for 14 days without a check-in; for servers with no internet, email support@liveitcg.com about an offline license.

Issuing and DNS validation

  • Unauthorized / forbidden from the DNS provider: the token is wrong, expired (GoDaddy tokens expire) or lacks rights to that zone. Update it under Credentials.
  • Zone not found: set the zone explicitly on the certificate (for example example.co.uk) and check it's the zone in that provider account.
  • The record never becomes visible: the domain's DNS may not be where you think. Check its name servers (nslookup -type=NS example.com) match the provider you chose. The server also needs outbound DNS (port 53) to check.
  • Certificate authority rate limits (Let's Encrypt allows 5 failed validations per name per hour; other CAs have their own): too many failed attempts or certificates for the same names in a short time. NeverLapse slows down by itself after repeated failures; fix the cause, then wait before trying again.
  • (NeverLapse on Windows) Windows DNS: RPC server unavailable or access denied: open TCP 135 and dynamic RPC ports to the DNS server, and make sure the account may change the zone (DnsAdmins).
  • BIND: update refused (REFUSED / NOTAUTH): the TSIG key name, secret or algorithm doesn't match named.conf, or the zone's update policy doesn't allow it.

Deploying

  • Issued but not on my server: Issue now doesn't deploy. Click Deploy all now on the Dashboard, or wait for the nightly check. Agents install at their next check-in (within a minute by default, or the host's Agent check-in interval).
  • (NeverLapse on Windows) Windows push: access denied or RPC unavailable: see Windows servers. Behind a firewall? Use the agent type instead.
  • IIS still shows the old certificate: pick the binding on the host's page (on a push host, tick This host runs IIS first); importing alone doesn't change IIS. See IIS bindings.
  • IIS site gives a TLS or handshake error, or has no certificate: before NeverLapse Cert 1.3.5, IIS binding never worked. Upgrade (then update the IIS agents from the Hosts page; for push hosts click Deploy on the Hosts page). Otherwise check Last error on the host's page. On the server, netsh http show sslcert should list the site's hostname:port (or ip:port) with the certificate's hash.
  • Post-deploy script failed: the error is in the deployment result. Run the script by hand on that server to see it.
  • Veeam refuses the certificate: set the one-time registry value and restart the Veeam Backup Service.
  • Exchange host shows an error: the error is under Agent status on the host's page, and the agent retries at every check-in. "The Exchange management tools aren't on this server" means the agent isn't on the Exchange server; install it there. If the port 443 / Outlook on the web check failed, the previous IIS certificate was put back and the new one stays imported; check it with Get-ExchangeCertificate in the Exchange Management Shell (more).
  • Remote Desktop Services host shows an error: it's under Agent status on the host's page, with the last change step by step. "Access is denied" for a Gateway or Web Access on another server: add the broker's computer account to that server's local Administrators group. "isn't the RD Connection Broker" or "RemoteDesktop module isn't on this server": install the agent on the broker. After a failed check the previous certificates are already back; the new one is tried again after 15 minutes (more).
  • nginx host shows an error: it's under Agent status on the host's page. The agent already put the previous files back and reloaded nginx. "nginx -t failed" quotes nginx's own message (often a different site's broken config); "the check after the reload failed" means the site still served another certificate, for example a second (ECDSA) certificate pair. Fix it, then run sudo neverlapse-agent run --force on the server, or wait 15 minutes (more).
  • Apache Tomcat host shows an error: it's under Agent status on the host's page, with the last change step by step. "server.xml has no <Connector port=...>": set the HTTPS connector's port on the host's page (the message lists the connectors it found) or add an HTTPS connector to Tomcat. "isn't an HTTPS connector": that port's connector has no SSLEnabled="true". "several Tomcat installs / units": fill in server.xml and Service on the host's page. After a failed restart or check the previous server.xml and keystore are already back; the certificate is tried again after 15 minutes (more). Tomcat's own reason is in its logs folder.

Agents

See If an agent doesn't pick up a certificate. In short: check Agent status on the host's page; on Linux run sudo neverlapse-agent status and sudo neverlapse-agent run; after regenerating the shared token, run each agent's install command again. To remove a Windows agent, use Settings > Apps (NeverLapse Cert Agent) or NeverLapseAgent.exe /UNINSTALL from an elevated prompt; certificates it already placed stay (details).

VMware Cloud Director cells: see what happened with journalctl -u neverlapse-agent. The cell's previous certificate files are backed up in /var/lib/neverlapse-pull/vcd-backup. A failed swap is rolled back and held for 6 hours; sudo neverlapse-agent run --force tries again now (more).

Still stuck?

Email support@liveitcg.com with what you see (a screenshot of the error helps) and your NeverLapse version (shown at the bottom of the menu).

Previous Backup, upgrade, move, uninstall