Download Software Product List - Failing

[sgrechtman]

Edited the task, no changes, and saved it.  Ran it again...

12/15/16 10:21:33 AM	Started: Download Software Product List
12/15/16 10:21:39 AM	Downloading file D:\PROGRA~1\McAfee\EPOLIC~1\DB\licensed_products_list.xml.tmp.
12/15/16 10:21:39 AM	Downloading file D:\PROGRA~1\McAfee\EPOLIC~1\DB\trial_products_list.xml.tmp.
12/15/16 10:21:39 AM	Failed to download file D:\PROGRA~1\McAfee\EPOLIC~1\DB\licensed_products_list.xml.tmp. There was an error connecting to the server (-2146893018).
12/15/16 10:21:39 AM	Failed to download file D:\PROGRA~1\McAfee\EPOLIC~1\DB\trial_products_list.xml.tmp. There was an error connecting to the server (-2146893018).
12/15/16 10:21:39 AM	Failed to connect to the Software Catalog server.
12/15/16 10:21:39 AM	Completed: Download Software Product List (Failed to download the products list due to "Failed to connect to the Software Catalog server.")

[tao]

Interesting, any additional entries in the EpoApSvr.log around that time?

[sgrechtman]

20161215102139    I    #09264    DOWNLOADJNI    Downloading File D:\PROGRA~1\McAfee\EPOLIC~1\DB\licensed_products_list.xml.tmp.

20161215102139    I    #09264    MCUPLOAD    Connecting directly to server epo.mcafee.com.

20161215102139    I    #09836    DOWNLOADJNI    Downloading File D:\PROGRA~1\McAfee\EPOLIC~1\DB\trial_products_list.xml.tmp.

20161215102139    I    #09836    MCUPLOAD    Connecting directly to server epo.mcafee.com.

20161215102139    I    #09264    MCUPLOAD    Successfully disabled CA trust options.

20161215102139    I    #09836    MCUPLOAD    Successfully disabled CA trust options.

20161215102139    E    #09264    MCUPLOAD    Failed to send http request.  Error=The message received was unexpected or badly formatted.

20161215102139    E    #09264    MCUPLOAD     (-2146893018)

20161215102139    I    #09264    DOWNLOADJNI    Finished Downloading File D:\PROGRA~1\McAfee\EPOLIC~1\DB\licensed_products_list.xml.tmp (0 bytes).

20161215102139    E    #09836    MCUPLOAD    Failed to send http request.  Error=The message received was unexpected or badly formatted.

20161215102139    E    #09836    MCUPLOAD     (-2146893018)

20161215102139    I    #09836    DOWNLOADJNI    Finished Downloading File D:\PROGRA~1\McAfee\EPOLIC~1\DB\trial_products_list.xml.tmp (0 bytes).

[tao]

"Failed to send http request.  Error=The message received was unexpected or badly formatted." & " (-2146893018)"  reminds me of either a Proxy or HTTPS inspection is enabled.

[sgrechtman]

I Just tried going to this URL on another Server 2003 box:

https://epo.mcafee.com/ProductCompatibilityList.xml

It fails as well... Did something change with epo.mcafee.com where it doesn't support connections coming from Server 2003?  I guess it still could be our web filtering, but until I'm able to get more assistance from our network team, I'm stuck.

[tao]

Perhaps it's worth asking the network team for a web filtering report on the ePO server/IP (sometimes just the server name doesn't pull the web history - you may need to also run the same report with the IP) for today between 12:10 - 12-20 ...

[syedali]

Hi

I had ran into a similar kind of an issue where https inspection was enabled which eventually resulted in Ssp was unable to validate the trusted root certificate. Did you check event logs for schannel events during the time of the issue as below

Event Type: Warning

Event Source: Schannel

Event Category: None

Event ID: 36885

[sgrechtman]

Well I did some research with our network team, and doesn't appear that the traffic is being blocked/filtered.

I believe the issue is something with Server 2003 and the current TLS/Cipher Suite requirements of "epo.mcafee.com".....Handshake failures just like someone else mentioned in an earlier post.

Can anyone else confirm this?  I can't be the only one running into this issue.

Is there a workaround to manually download/update the software product list?

[syedali]

Hi

From the logs that you have posted the trusted root certificate option seems to be disbaled. Did you check the CA store on the system is the root certificate present ?

Try the following and let us know.

The certificate used by the Software Manager site has been changed. Normally this process is transparent to users, as the new certificate is automatically downloaded and installed via Microsoft's Automatic Root Certificate Update system. (For details, see the How Windows Updates Root Certificatessection in the following Microsoft support document:http://support.microsoft.com/kb/931125)However, if the process fails or automatic root certificate updating is disabled, the certificate is not downloaded and installed.

Solution

To resolve this issue, manually install the required certificate in the computer account on the ePO server.Prerequisite:
Download the AddTrustExternalCARoot certificate from the following, and save it to a temporary location:
https://support.comodo.com/index.php?/Default/Knowledgebase/Article/View/853/74/addtrustexternalcaro...Perform the following steps on the ePO server to import the certificate:

1. Click Start, Run, type MMC and click OK.
2. Click File, Add/Remove Snap-in.
3. Click Add in the Standalone tab.
4. Select the Certificates snap-in and click Add.
5. Select Computer account and click Next.
6. Click Finish.
7. Click Close in the Add Standalone Snap-in window.
8. Click OK in the Add/Remove Snap-in window.
9. Expand Certificates(Local Computer), Trusted Root Certification Authorities.
10. Right-click Certificates and click All Tasks, Import.
11. Click Next.
12. Browse to the AddTrustExternalCARoot.crt file that was downloaded earlier and click Open.
13. Click Next.
14. Click Next.
15. Click Finish. A dialog stating The import was successfuldisplays.
16. Click OK.

Run the Download Software Product List task:

1. Log on to the ePO 4.6 / 5.0 console.
2. Click Menu, Automation, Server Tasks.
3. Locate the Download Software Product List task and click Run under the Actions column.
4. Review the Server Task Log to ensure the task runs successfully.

[sgrechtman]

This is not a certificate issue.  I have already done all those steps mentioned to readd the cert (even though it was already there and valid).  It still fails.