Skip to content

Knowledge Base · Category 15

Troubleshooting

10 articles

If an issue or renewal fails, TLSPilot shows the error with the details of the CA in the result dialog, and the tooltip of Next action shows Fix error, then Force renew. The following tables are sorted by area. For each symptom, they show the message of TLSPilot, the cause and the solution. Texts in angle brackets, for example <name>, are filled in by TLSPilot. Where to find the messages is described in chapter Logs and diagnosis.

Articles in this category

  1. 15.1

    ACME

    For an order error, TLSPilot shows the error type of the CA, for example urn:ietf:params:acme:error:rateLimited, followed by its details.

  2. 15.2

    DNS-01

    With DNS-01, TLSPilot creates a TXT record _acme-challenge.<name> with the DNS provider, waits for propagation, lets the CA validate it and deletes it again.

  3. 15.3

    HTTP-01 and TLS-ALPN-01

    With HTTP-01, the CA fetches http://<public-name>/.well-known/acme-challenge/…. TLSPilot publishes the file with the option selected for the certificate: Listener on this management host (port 80), Local webroot on this management host, Remote Windows web server (WinRM) or Remote Linux web server (SSH).

  4. 15.4

    Deployment targets

    A failed deployment is logged as event 1302, a failed Health check as event 1322.

  5. 15.5

    RBAC, Entra ID and break-the-glass

    Access errors are logged in the Audit channel. Members of the local group Administrators on the management host can always sign in as break-the-glass Owner while that setting is on.

  6. 15.6

    WebUI and HTTPS binding

    The WebUI runs as Windows service iTrainTLSPilotWebService. Its log is %ProgramData%\iTrain\TLSPilot\logs\webservice-<date>.log.

  7. 15.7

    Service and daily cycle

    The management service iTrainTLSPilotMgmtService runs the daily cycle. Its log is %ProgramData%\iTrain\TLSPilot\logs\service-<date>.log (kept for 30 days).

  8. 15.8

    License and activation

    License events are logged in the Operational channel (1530–1538). The activation needs HTTPS access to license.itrain.ch.

  9. 15.9

    PowerShell module

    The module needs Windows PowerShell 5.1 or later and connects to the management API, by default http://127.0.0.1:5188, see chapter Import the module and check the connection.

  10. 15.10

    Logs and diagnosis

    TLSPilot writes events to the Windows Event Viewer and to log files. The logs are also available in the Desktop Admin console under Tools → View logs & audit…, see chapter Logging, and with Get-TLSPilotLog.