SSL Error: The remote certificate is invalid according to the validation procedure

NOTE – The actual certificates needed may change, but the fundamental concept should always be relevant.

An exception occurred in MaintaintConnection|{ "exception": {"Message":"SSL Error The remote certificate is invalid according to the validation procedure.", "Data":{}, "InnerException":{"Message":"The remote certificate is invalid according to the validation procedure.",

When a connection is made (in general), a device will check what certificate is presented by the target address and then make sure that certificate is deemed to be "trusted" by the device, as configured by the trusted certificates on the device. This Error typically means that the certificate it found for the URL was not in the list of trusted certificates on the device.

NOTE – It could also mean that the device trying to connect simply has the wrong time configured. SSL requests from the future will not be approved =). Check system time and fix it if it is off.

SOLUTION 1

IF the partner has shell access to the device, try the following commands in powershell

certutil.exe -generateSSTFromWU C:\Temp\roots.sst

$sstStore = ( Get-ChildItem -Path C:\Temp\roots.sst )
$sstStore | Import-Certificate -CertStoreLocation Cert:\LocalMachine\Root
 

This will force the device to update it's certs via contacting Windows Update. See below article for context, though it appears the commands in this article are not formatted right. Above is the simpler and tested set of commands. 

https://woshub.com/updating-trusted-root-certificates-in-windows-10/#h2_3 

SOLUTION 2

The above should resolve the majority of these cert issues, but if needed you can review the certs that are currently trusted in Windows MMC. You'll need to do this on a screenshare with the partner to the affected device.

1. Type MMC in the Windows Run box and click the toolbox icon
2. Go to file > add snap in and select certificates > Computer account
3. 

1. Under Trusted Root Certificate Authorities, you can see which certs are trusted by the device (though bear in mind there is some variance in names etc)
2. 

3. You can use sites like https://www.sslshopper.com/ssl-checker.html to confirm which certificate is being presented by our servers, but as of writing they all seem to be the same DigiCert (see below). Note that some platforms have multiple cc servers, but log.txt will show you which the agent is attempting connection to. If needed, certificates can be manually imported to the device in MMC.

   1. NOTE – when checking for which certs are needed with the website online, make sure you're checking the "Control" servers, which are the ones with "cc" in the title typically. Don't use the URL for the web portal because that will only affect user logon activity. Device connectivity connects to a completely different URL entirely: