Windows Admin Center Can't Access .local Domain After .com Cert Install

Hi Joe,

Thank you for your contribution and for sharing answer—it’s greatly appreciated! Apologies for the delay in getting back to you.

The error message indicates that Windows Admin Center cannot search Active Directory.

Allow me to share some other possible causes as bellow:

• Invalid certificate
  • A certificate might be invalid. This shows as "invalid certificate."
  • Even if you don't see an error on WindowsAdminCenter event log, the browser could indicate invalid certificate status as icon at the address bar. WACv2 can't be used if an invalid certificate is used when communicating with the sub processes.
  • You shouldn't generate a self-signed certificate because it's a security issue.
• Mismatched DNS name
  • The certificate DNS name might be different from the WAC DNS name.
  • If this isn't resolved then WAC might not work or bring errors.
• Wrong or inaccurate thumbprint
  • Check that the thumbprint is present, correctly registered, and doesn't match what is expected. WAC might not detect the certificate.
• Private Key not configured to be accessed by the network service
  • HTTPS protocol layer reads private key of certificate to encrypt TLS payload when communicating over HTTPS protocol.
  • WAC uses Network Service account, so Private Key must be accessible by Network Service. Use certlm.msc tool to select All Tasks menu to open Manage Private Keys... dialog.
  • Make sure NETWORK SERVICE is configured to access the private key.
• Network, Policy and Firewall configuration issues
  • If you restrict TLS communications, then the WAC Gateway might not be able to access the certificate. This might be firewall or GPO issue.

Resolution:

• Ensure the Windows Admin Center server is joined to your Active Directory domain.
• Verify your user account has the necessary permissions to access and read from Active Directory.
• Confirm the certificate installed is valid for the server’s FQDN.
• Make sure the Network Service account has access to the certificate’s private key for secure communication.

Your note about rerunning the installer and updating the FQDN during the custom install option is an excellent tip for resolving domain type mismatches (.local to .com).

Here's the official article according to question: https://v4.hkg1.meaqua.org/en-us/windows-server/manage/windows-admin-center/configure/update-certificate?tabs=powershell

Thanks again for your dedication to Learn community!

If you believe this information adds some value, please accept the answer so that your experience with the issue would help contribute to the whole community.

Regards,

I should have waited to post this as I've now found the answer. The issue appears to be a FQDN that needed updated.

It appears that you can't change domain type, .local to .com, via CLI. You need to rerun the installer and use the custom install option. After you import the cert you will be prompted with a FQDN page. Make sure to change .local to .com on that page and when the server finishes setting up again it will work.