Service McAfee ePolicy Orchestrator 5.10.0 Server (MCAFEEAPACHESRV) failed to start (installation of the Agent Handler certificates fail)

Technical Articles ID: KB91538
Last Modified: 1/9/2020

Environment

McAfee ePolicy Orchestrator (ePO) 5.10.x

Problem 1

When you try to install an ePO 5.10 Agent Handler, the installer pauses for several minutes at the 'Starting services' stage. Finally it displays a dialog box that reads as follows:

Error 1920. Service McAfee ePolicy Orchestrator 5.10.0 Server (MCAFEEAPACHESRV) failed to start.
Verify that you have sufficient privileges to start system services

NOTES:

If you click Retry, the same dialog box is displayed after a few minutes.
If you click Cancel, the installation fails and rolls back

Problem 2

When you try to regenerate the Agent Handler certificates in ePO 5.10 (as described in KB90760), the process is not successful.

Only the following three files are created in the ssl.crt folder:

ahsetup_<host_name>.log
mfscabundle.cer
pkcs12store.properties

Where <host_name> is the name of the system where the command is being run.

Problem 3

The following is applicable to both Problem 1 and 2 above.

The Ahsetup_<host_name>.log records the following (located in %TEMP%\McAfeeLogs\):

AHSETUP The Agent Handler successfully connected to the ePO server.

AHSETUP certificates.cpp(956): Received an unexpected error from the server '<ePO Server Name>': Error 1 :

AHSETUP No such command: uncaughtThrowable

IMPORTANT: If you do not see this error in the log, you do not have the issue described in this article.

Cause

This problem occurs when the certificates used internally by ePO have a key size of 1024 bits and the ePO server was upgraded over time from ePO 4.5. The cryptography settings in ePO 5.10 do not allow a 1024-bit certificate to be created. So, when the agent handler installer tries to create a 1024-bit certificate, the process fails.

Solution

This issue will be resolved in a future release or updated version of the product. As a temporary measure, implement the workaround shown below.

To receive email notification when this article is updated, click Subscribe on the right side of the page. You must be logged on to subscribe.

To receive information about product updates, sign up for the Support Notification Service.

Workaround

Temporarily disable the setting that blocks the creation of a 1024-bit certificate:

CAUTION: This article contains information about opening or modifying the registry.

The following information is intended for System Administrators. Registry modifications are irreversible and could cause system failure if done incorrectly.
Before proceeding, Technical Support strongly recommends that you back up your registry and understand the restore process. For more information, see the Microsoft Windows registry information for advanced users article.
Do not run a REG file that is not confirmed to be a genuine registry import file.

Take the following actions on the ePO server:

Stop the ePO services:
1. Press the Windows key + R.
2. Type services.msc into the field and press Enter.
3. Right-click each of the following ePO services and select Stop:
  
  McAfee ePolicy Orchestrator #.#.# Application Server
  McAfee ePolicy Orchestrator #.#.# Event Parser
  McAfee ePolicy Orchestrator #.#.# Server
4. Minimize the services window.
Open regedit
1. Press the Windows key + R.
2. Type regedit into the field and press Enter.
3. Navigate to the following registry Hive:
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Apache Software Foundation\Procrun 2.0\MCAFEETOMCATSRV5100\Parameters\Java
4. Right-click on Java, and select Export, to save a backup copy of this key.
5. To edit it in the multi-string editor, double-click the Options value.
6. Locate the option: -Dorg.bouncycastle.fips.approved_only=true
7. Change the setting to false, so that it looks like: -Dorg.bouncycastle.fips.approved_only=false
8. Click OK.
Start the ePO services:
1. Access the services window minimized in step 1.
2. Right-click each of the following ePO services and select Start:
  
  McAfee ePolicy Orchestrator #.#.# Application Server
  McAfee ePolicy Orchestrator #.#.# Event Parser
  McAfee ePolicy Orchestrator #.#.# Server
3. Allow all services to start.
4. Close the services window.
Log on to ePO console.
Install the Agent Handler again.
Once the Agent Handler is installed, take the following two actions:
1. On the Agent Handler, stop the ePO services.
2. On the ePO server, stop the ePO Application Server service again.
Reset the Java option back to true again: -Dorg.bouncycastle.fips.approved_only=true
On the ePO server, start the ePO Application Server service again.
On the Agent Handler, start the ePO services.

Affected Products

ePolicy Orchestrator 5.10.x
Install/Uninstall
Known Issue/Product Defect
Upgrade/Migrate

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Japanese
Portuguese Brasileiro
Chinese Simplified

Knowledge Center

Service McAfee ePolicy Orchestrator 5.10.0 Server (MCAFEEAPACHESRV) failed to start (installation of the Agent Handler certificates fail)

Environment

Problem 1

Problem 2

Problem 3

Cause

Solution

Workaround

Affected Products

Languages:

Title

Title

Knowledge Center

Service McAfee ePolicy Orchestrator 5.10.0 Server (MCAFEEAPACHESRV) failed to start (installation of the Agent Handler certificates fail)

Environment

Problem 1

Problem 2

Problem 3

Cause

Solution

Workaround

Affected Products

Languages:

Choose your region

Title

Title