Troubleshoot with SSL Certificate Revocation Check Mode

Troubleshoot and possible fix SSL/TLS connections with the SSL Certificate Revocation Check Mode policy for your Omnissa Workspace ONE Experience Management agents. This mode checks if a previously valid certificate was recently revoked. To configure this policy for Windows, use the Workspace ONE Endpoint ADMX template bundled with the agent to activate the policy and set the check mode. To configure this policy for macOS, set the mode in the agent's config file.

Symptoms

Use this troubleshooting topic if you see that Experience Management data is not flowing to Omnissa Intelligence and the logs report failed SSL/TLS connections.

Regular validations versus extra checks

• Regular validations: Whenever the Experience Management agent connects to the Omnissa Intelligence backend over HTTPS, the agent validates the server's certificate.
  • It confirms that a trusted certificate authority (CA) issues the certificate, that it matches the hostname, and that it hasn't expired.
  • This validation always happens.
• Extra validation: Use the SSL Certificate Revocation Check Mode policy to add an optional check to see whether a validly issued certificate has since been revoked.
  • For example, a certificate can get revoked because its private key was compromised or it was mis-issued.
  • This additional check requires reaching a separate CRL (Certificate Revocation List) or OCSP (Online Certificate Status Protocol) endpoint, which is unrelated to the Intelligence server the agent currently talks to.
  • If the agent can't reach the revocation endpoint, you can choose whether that failure should also block telemetry uploads.
  • Examples of the agent not reaching the revocation endpoint include a proxy that hasn't allowlisted the endpoint yet or the CA has rotated the endpoint.

Supported agent version

This setting is available starting with the Experience Management agents for macOS and Windows version 26.07 and later.

Available modes

Select from three modes when you configure SSL Certificate Revocation Check Mode. This is an additional check from the regular, certificate chain validation check, which always happens no matter what mode you configure.

Limitations

Be aware of the current limitations before using SSL Certificate Revocation Check Mode.

WinHTTP limitation

Soft-fail and hard-fail are fully supported on the Experience Management agent's default HTTPS backend using libcurl. Windows uses Schannel (Secure Channel) and macOS uses Apple's Security framework.

If your deployment uses WinHTTP (an optional, deprecated Windows backend that is not the default), be aware that WinHTTP only supports revocation checking as on or off, with no soft-fail concept. On the backend, soft-fail and hard-fail behave identically — both enforce strictly.

Logging limitations

If you plan to monitor or audit specifically for "the revocation check couldn't reach the responder, but the connection proceeded anyway" under soft-fail, note that current logs don't distinguish that outcome.

• Windows (libcurl + Schannel, default): No distinct log entry exists.
  • The check happens inside Windows' Schannel component, which reports only a final pass or fail.
  • It does not report whether revocation was inconclusive versus positively confirmed.
• macOS: Logged at debug level as "Certificate chain is trusted".
  • This message is the same message used when revocation is positively confirmed as not-revoked.
  • The two outcomes aren't distinguishable in the log.

If you need visibility into revocation-endpoint reachability specifically, the agent's own logs can't currently provide that on any platform.

On Windows, you can activate and audit Schannel and CAPI2 event logs separately. See Microsoft's Tech Community blog How to Configure and Collect Schannel and CAPI2 Logs.

Requirements

Perform the required tasks before you configure SSL Certificate Revocation Check Mode.

Test security-related settings

You must review and test configuration changes to security-related settings in your environment before broad deployment.

Hard-fail requirements

Hard-fail requires the Experience Management agent to successfully reach the certificate's CRL or OCSP endpoint on every connection. If the system can't, the system blocks the connection and the telemetry uploaded with it. Before turning hard-fail on, take the listed steps for Windows and macOS.

1. Allowlist CRL (Certificate Revocation List) or OCSP (Online Certificate Status Protocol) endpoints for your region's Intelligence destinations on any egress proxy or firewall.
   • Refer to the current published endpoints by region in the CRL or OCSP lists.
   • Find the Intelligence regions at Allowlisting URLs by region for service destinations.
2. Wildcard allowlist where possible.
   • These host names can rotate periodically without advance notice from the certificate authority, so allowlist the wildcard domains *.amazontrust.com and *.amznts.eu.
   • Allowlisting these wildcard domains helps with rotating host names rather than only allowlisting today's specific host names.

If you can't guarantee reachability, soft-fail mode provides most of the same security benefits without the outage risk.

Windows-specific requirement (reminder)

If your deployment uses the WinHTTP backend rather than the default libcurl backend, be aware that WinHTTP has no soft-fail concept. There's nothing to configure differently for WinHTTP; it's a constraint to plan around, not a setting.

Windows configuration

Use a group policy object, GPO, to set SSL Certificate Revocation Check Mode.

1. Download the Workspace ONE Endpoint Telemetry ADMX template which is bundled with the agent on the Customer Connect downloads page.
2. Use the SSL Certificate Revocation Check Mode setting found at the listed policy structure.

Computer Configuration → Administrative Templates → Workspace ONE Endpoint Telemetry
→ Service Configuration → HTTP → SSL Certificate Revocation Check Mode

1. Set the policy to Enabled and choose Off, Soft-fail, or Hard-fail from the drop-down.
   • Leaving the policy Not Configured keeps the agent at its default, soft-fail.

Registry and values for reference

If you have your own method for configuring this check, use the registry path and values.

• Value name: SslRevocationCheckMode (string)
• Values: off, soft-fail, hard-fail (case-insensitive)
• An absent or unrecognized value falls back to soft-fail.
• If both the GPO and local registry values are set, the GPO value takes priority.

macOS configuration

Set the mode in the agent's config file to set SSL Certificate Revocation Check Mode. Use Terminal with administrator rights on the macOS device. Use the listed values. An absent or unrecognized value falls back to soft-fail.

• Value name: SslRevocationCheckMode (string)
• Values: off, soft-fail, hard-fail (case-insensitive)

Procedure

1. Find the config file at the path /etc/workspaceone/ws1etlm/config/config.ini and open it.
2. Find the [HttpLib] section.
3. Add the line SslRevocationCheckMode="<mode>".
   • Example: SslRevocationCheckMode="soft-fail"