ERROR: Invalid primary Agent Handler ID (ePO 5.9 Certificate Migration fails)

技術的な記事 ID: KB89152
最終更新: 1/21/2020

環境

McAfee ePolicy Orchestrator (ePO) 5.9 and later

問題

The Certificate Migration process fails. The following error is displayed:

One or more managed products failed during certificate regeneration.

The Certificate Manager rolls back the ePO certificates to the previous SHA-1 state.

The ePO orion.log contains an error similar to the following:

ERROR [http-nio-8443-exec-12] service.EPOAgentHandlerRegisteredCertificateImpl - Exception occurred while regenerating sitelist
com.mcafee.epo.core.EpoValidateException: Invalid primary Agent Handler ID.

ERROR [http-nio-8443-exec-3] service.EPOAgentHandlerRegisteredCertificateImpl - Exception occurred while regenerating sitelist
com.mcafee.epo.core.EpoValidateException: Invalid fallback Agent Handler ID.

システムの変更

You upgraded to ePO 5.9 and executed the Root Certificate regeneration process via the new Certificate Manager.

原因

The most common cause for this issue is that an older McAfee Agent Deployment URL (Smart Installer) exists in an invalid state.

A similar but slightly different root cause can also lead to the same symptom. In this situation, an Agent Deployment URL exists in an invalid state. Which points to an Agent package that no longer exists in the ePO Master Repository. The Certificate Migration fails with the same error. See Solution 2 for how to resolve this issue.

解決策

To delete invalid Agent Deployment URLs:

Make note of the ID number of the impacted handler referenced in the orion.log error message.

For example, in the following sample error we see that the invalid handler ID is 6:

ERROR [http-nio-8443-exec-12] service.EPOAgentHandlerRegisteredCertificateImpl - Exception occurred while regenerating sitelist
com.mcafee.epo.core.EpoValidateException: Invalid primary Agent Handler ID. ID: 6
To find any Agent Deployment URLs that use this invalid handler, query the ePO SQL database using:

Select * from EPOAgentDeploymentInfo where PrimaryAgentHandlerId = 'X' OR FallbackAgentHandlerId = 'X'

Where X is replaced with the corresponding value of the invalid handler in your environment orion.log.
Make note of the name of each URL returned from the previous step in the UrlLabel column.
Log on to the ePO console and navigate to the System Tree.
Select My Organization, then select the Agent Deployment tab.
To see all Agent Deployment URLs throughout the tree, Change the Preset to view This Group and All Subgroups.
Find the matching URL names returned from step 3 and delete them, re-creating them afterward if needed.
Reinitiate the Certificate Migration process.

解決策

For instances where an Agent Deployment URL exists in an invalid state and points to an Agent package that no longer exists in the ePO Master Repository:

Log on to the ePO console and navigate to the System Tree.
Select My Organization, then select the Agent Deployment tab.
To see all Agent Deployment URLs throughout the tree, Change the Preset to view This Group and All Subgroups.
Locate and delete any invalid Agent Deployment URLs (highlighted in red text).
Reinitiate the Certificate Migration process.

影響を受ける製品

ePolicy Orchestrator 5.9
ePolicy Orchestrator 5.10.x
Upgrade/Migrate

言語:

この記事は、次の言語で表示可能です:

German
English United States
Spanish Spain
French
Italian
Japanese
Portuguese Brasileiro
Chinese Simplified

技術用語集

用語集にある用語をハイライトする

当社の技術用語集を参照してください。

Knowledge Center

ERROR: Invalid primary Agent Handler ID (ePO 5.9 Certificate Migration fails)

環境

問題

システムの変更

原因

解決策

解決策

影響を受ける製品

言語:

技術用語集

Title

Title

Knowledge Center

ERROR: Invalid primary Agent Handler ID (ePO 5.9 Certificate Migration fails)

環境

問題

システムの変更

原因

解決策

解決策

影響を受ける製品

言語:

技術用語集

地域を選択してください

Title

Title