On-Demand Assessment signing certificate expired

Question

On-Demand Assessment signing certificate expired

Luca Fabbri 156

Hello,
starting from 1st of September 2022, we are experiencing issues with On-Demand Assessments (Active Directory, Azure Active Directory).
File processed.trace.<GUID>.adassessment.assessmenttrace reports this error:

Method=LoadCertificate Message=Certificate has expired or has no valid root. Thumbprint=8740DF4ACB749640AD318E4BE842F72EC651AD80 Subject=CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US ErrorMessage=Chain Status=NotTimeValid ChainStatusInfo=A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

Method=Main Message=Unable to load package. PackagePath=C:\Program Files\Microsoft Monitoring Agent\Agent\Health Service State\Resources\62\AzureAssessment.execpkg

Looking at C:\Program Files\Microsoft Monitoring Agent\Agent\Health Service State\Resources\62\AzureAssessment.execpkg, it seems was signed by a certificate expired on 1st of September 2022:

Tasks already performed:

Uninstalled and installed the latest version of Microsoft Monitoring Agent (MMA) v10.20.18067.0 - downloaded from the Log Analytics workspace
Remove-AzureAssessmentTask and Add-AzureAssessmentTask again (I discovered the PowerShell cmdlet doesn't support the -MFA parameter, despite I can found it referenced in Microsoft documentation - so I had to removed the MFA for the Azure AD users used for the Assessment) => same SSL certificate error

Any advice or recommendation to solve this issue ?

Thank you,
Luca

5 answers

Your answer

Answer 1

Givary-MSFT 35,626 Microsoft Employee Moderator

@Anonymous Thank you for reaching out to us. As I understand you are experiencing issues with On-Demand Assessments (Active Directory, Azure Active Directory)

Reviewed the documentation for Active Directory On-Demand Assessment and Azure Active Directory On-Demand Assessment

You need to contact Services Hub and raise a request from this portal https://serviceshub.microsoft.com/gethelp by selecting appropriate option.

Let me know if you have any further questions.

shabarinath 1 Reputation point

2022-09-13T19:03:40.613+00:00

Iam also facing the same issue.

Givary - Please don't redirect us to the generic documentation which is of no use. This issue is due to the certificate expiry, which was used to digitally sign the package.
Could you please let us know how we can get the latest package refreshed?

Thanks
Givary-MSFT 35,626 Reputation points Microsoft Employee Moderator

2022-09-14T05:24:38.31+00:00

@Anonymous & @shabarinath

Let me check internally with my team on this issue and will keep you posted.
Luca Fabbri 156 Reputation points

2022-09-14T07:57:38.927+00:00

Hello,
I already know I have to pass through Service Hub to get support about On-Demand Assessments however I'd like to share my experience (in case someone else got the same issue).
However I received a confirmation from Microsoft: "We are experiencing issues with all of our Assessments due to a certificate expiry issue."

Regards,
Luca
Givary-MSFT 35,626 Reputation points Microsoft Employee Moderator

2022-09-14T08:14:56.127+00:00

@Anonymous Thanks for the update. I have also raised a request as well with Service Hub to investigate this issue further, once I hear from them, will update this post too.
Givary-MSFT 35,626 Reputation points Microsoft Employee Moderator

2022-09-14T09:56:12.323+00:00

@Anonymous & @shabarinath

Update: Our team is aware of this issue and fixed the certificate expiry issue mentioned in the query, ETA to roll out the fix is mid of next week.

Apologies for the inconvenience. Let me know if you have any further questions.
shabarinath 1 Reputation point

2022-09-16T12:55:45.21+00:00

Hi Givary-MSFT,

Could you please let us know how to move forward?
Once the fix is released, What is expected from customers to get ODA jobs successful?

Appreciate if you can provide the steps or some directions on how to get this issue resolved.

Thanks
Brian-2473 6 Reputation points

2022-09-18T20:56:03.25+00:00
Hi Shabarinath,

Once the fix has been released, you can force the new files to download by following these steps:

Stop Microsoft Monitoring Agent (HealthService) service.

Delete the Health Service State folder. The default location is C:\Program Files\Microsoft Monitoring Agent\Agent\Health Service State.

Start the HealthService.

I checked a few minutes ago, the files still have the old digital signature.
shabarinath 1 Reputation point

2022-09-20T17:16:48.997+00:00

Thanks Brian.

Hi Givary-Msft,

Please let us know once the fix is out so that we can try to re-run the jobs.

Thanks
Shaba
Savan Kariya 6 Reputation points

2022-09-21T06:10:36.97+00:00

Hi Givary-Msft,

We are also facing the same issue where the Ondemand assessment results are not populating on log analytics workspace after 30th of Aug 2022. We are also seeing the same certificate error.

Please let us know once the solution is available, so we can check and confirm.

[20220919_230010] [0001] SironaCore Warning: 6 : [20220919_230010] [0001] Core Advisor(741b5d0d-887e-4e4d-93db-899f61a587e6) Warning: ActivityID=2691a33b-c34f-0000-a57d-9c264fc3d801 Method=LoadCertificate Message=Certificate has expired or has no valid root. Thumbprint=8740DF4ACB749640AD318E4BE842F72EC651AD80 Subject=CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US ErrorMessage=Chain Status=NotTimeValid ChainStatusInfo=A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.
Pollard, Shane 1 Reputation point

2022-09-21T14:08:03.04+00:00

Is there an update on this issue? We are seeing the same problem with our environment.
Givary-MSFT 35,626 Reputation points Microsoft Employee Moderator

2022-09-22T05:34:23.203+00:00

@Pollard, Shane

Apologies for the delayed response, as per the last update, fix is in deployment phase and let me check with my team for the ETA.
ChrisF 6 Reputation points

2022-09-23T10:20:41.72+00:00

Looks like the certificate issue is resolved. My Assessments are now running again.

I followed these steps from above:

Stop Microsoft Monitoring Agent (HealthService) service.

Delete the Health Service State folder. The default location is C:\Program Files\Microsoft Monitoring Agent\Agent\Health Service State.

Start the HealthService.

Answer 2

Luca Fabbri 156

Hello All,
the SSL certificate expiration issue was fixed on 23rd Sept by Microsoft.

Bye,
Luca

Answer 3

Hi,

Thank you for your question and reaching out. My name is Louie and I’d be more than happy to help you with your query.

I understand that you're experiencing issues with On-Demand Assessments.

Is your device in Windows 10 or 11?
When was the last time you access this successfully?

Kindly get back to us. Also, while waiting, you may access this link to get further information that could help you resolve the concern: https://learn.microsoft.com/en-us/services-hub/health/getting-started-ad

----------------------------------------------------------------------------------------------------------------------------------

If the reply was helpful, please don’t forget to Upvote or Accept as answer. Thank you!

Answer 4

shabarinath 1

Thank you Luca for confirming.

Answer 5

Egan 0

Hello,

i ran into this issue with the AMA On Demand Assessments. Basically all assessments downloaded from the Services Hub to the Data Collector got expired Certificates.

Is there a solution/workaround for this?

Thanks!

Share via

On-Demand Assessment signing certificate expired

5 answers

Your answer