Spotfire Server: Node Manager is not able to communicate with Spotfire Server due to error: The remote certificate is invalid according to the validation procedure

Description:

Spotfire Node Manager is not able to communicate with Spotfire Server node due to internal certificate issue. The following errors might appear in Node Manager's nm.log file:

ERROR;2024-12-16T14:50:25,314-06:00;2024-12-16 20:50:25,314;01eac83e-b8a4-411a-9c41-f60727db7d19;161449a8e0SIsw;62;;;Spotfire.Dxp.Services.Http.HttpClient;"Certificate validation error.

Chain error (RemoteCertificateChainErrors) found on 'https://<hostname>:9443/spotfire/manifest'.

Chain error: Error PartialChain - A certificate chain could not be built to a trusted root authority.

...

Certificate chain with problem: Chain information: , Revocation flag: ExcludeRoot, Revocation mode: NoCheck, Verification flag: NoFlag, Verification time: 12/16/2024 2:50:25 PM, Status length: 1, Application policy count: 1, Certificate policy count: {1}0, Element Information: 1[ Issuer name: CN=<internal issuer, not Tibco or Spotfire, Inc.>, C=US, L=US, O=<COMPANY_NAME>..."

... 

WARN ;2024-12-16T14:50:25,314-06:00;2024-12-16 20:50:25,314;01eac83e-b8a4-411a-9c41-f60727db7d19;161449a8e0SIsw;62;;;Spotfire.Dxp.Web.SiteManager;"Failed to read server information from '<hostname>.com:9443'"
Spotfire.Dxp.Services.ManifestReader+ManifestWebException: Could not connect to server 'https://<hostname>:9443/' to download manifest. ---> System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel. ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure."

Solution:

The issue was resolved by changing proxy settings in Spotfire.Dxp.Worker.Host.exe.config: 

Old value:

<proxy proxyaddress="<proxy machine hostname>" />

New value:

<proxy usersystemdefault="true" bypassonlocal="true" />

In some environments, Spotfire Node Manager might not be able to handle certificate verification on its own, so system proxy settings should be used instead of explicit proxy server names.

Note, The Windows OS proxy settings already specify correct proxy server address. Spotfire just uses these system settings, which then allows Windows OS to handle all proxy server certificate verification tasks.

Documentation reference:
https://learn.microsoft.com/en-us/dotnet/framework/configure-apps/file-schema/network/proxy-element-network-settings

Solution Details:
This problem could be resolved by setting Web Player configuration to use Windows OS system proxy settings:

1. Export Web Player configuration:

config.bat export-service-config --tool-password=myConfigToolPassword --capability=WEB_PLAYER --deployment-area=myDeploymentAreaName --force

2. Modify Web Player configuration file Spotfire.Dxp.Worker.Host.exe.config:

<configuration>
...
<applicationSettings>
<Spotfire.Dxp.Web.Properties.Settings>
...
<setting name="ProxyUsername" serializeAs="String">
<value>myProxyUserName</value>
</setting>
<setting name="ProxyPassword" serializeAs="String">
<value>myProxyPassword</value>
</setting>
</Spotfire.Dxp.Web.Properties.Settings>
</applicationSettings>
...
<system.net>
<defaultProxy>
<proxy usesystemdefault="true" proxyaddress="<proxy-server-name>" bypassonlocal="true" />
</defaultProxy>
</system.net>
</configuration>

Note, please use your own 'proxy-server-name' value: 

<proxy usesystemdefault="true" proxyaddress="<proxy-server-name>" bypassonlocal="true" />

3. Import Web Player configuration:

config.bat import-service-config --tool-password=myConfigToolPassword --config-name=newConfigName

4. Change Web Player to use the new configuration ("newConfigName") and restart it.

These configuration change is similar to this one:

https://support.revvitysignals.com/hc/en-us/articles/4408235769620-How-to-configure-proxy-settings-for-Maps-in-TIBCO-Spotfire-Web-Player