0

i succesfully created a simple WEF setup between two domain server (WS2019) it's all working great while it remain in HTTP protocol.

Once i try to take the leap to HTTPS, no more logs is going to the WEC server.

i got certificates on both host issued by the same CA i followed multiple procedures i found online and redo stuff while i was tshooting.

i can't manage to get this work.

on the wec server, in the winRm logs i always get "the The authorization of the user failed with error 5"

and on the client :

The forwarder is having a problem communicating with subscription manager at address https://:5986/wsman/SubscriptionManager/WEC. Error code is 5 and Error Message is <f:WSManFault xmlns:f="http://schemas.microsoft.com/wbem/wsman/1/wsmanfault" Code="5" Machine="myclientFQDN"><f:Message>The WinRM client cannot process the request. The destination computer (:5986) returned an 'access denied' error. Specify one of the authentication mechanisms supported by the server. If Kerberos mechanism is used, verify that the client computer and the destination computer are joined to a domain. Possible authentication mechanisms reported by server: Negotiate Kerberos ClientCerts </f:Message></f:WSManFault>.

i drop this here since i ran out of ideas Thanks

9
  • You need to specify if this is source or collector initiated. And the principal to which access is denied. It sounds like it may be the computer account.
    – Greg Askew
    Dec 9, 2021 at 13:50
  • you are right, sorry for the lack of details :
    – Gorshok
    Dec 9, 2021 at 14:54
  • it's source initiated. but i think i figured it out. the thing is i was only trying to setup HTTPS but i didn't want to specifically go trought an authentication by certificate. so i think i managed to make HTTPS work while remaining on a Kerberos authentication.
    – Gorshok
    Dec 9, 2021 at 15:03
  • on the source computer i specified the target subscription Manager like this : Server=https:// fqdnofcollector:5986/wsman/SubscriptionManager/WEC,Refresh=60,IssuerCA=<thumbprint of the CA certificate>. which i think would allow the use of HTTPS + cert authentication. now this was not working in this scenario.
    – Gorshok
    Dec 9, 2021 at 15:04
  • i just removed the IssuerCA part in the string and now it's working. i think i'm now in this scenario : Https + kerberos auth i checked with Wireshark and it's indead HTTPS. So now it's working but i have no way to be sure i'm indeed using kerberos. but at least i reached the obejctive which was to enable log forwarding trough HTTPS
    – Gorshok
    Dec 9, 2021 at 15:07

1 Answer 1

0

To make HTTPS works we just have to do the regular stuff we find online.

set the HTTPS listener on the WEC server, generate certificates, set the string on the source for target subscription manager ...

the problem for me was while i was enabling HTTPS i was also trying to set cert authentication. which was not mandatory for me.

i just wanted the logs to be encrypted while they was send trough the network

the fix was changing the target subscription manager from :

Server=https:// fqdnofcollector:5986/wsman/SubscriptionManager/WEC,Refresh=60,IssuerCA=thumbprint of the CA certificate

to Server=https:// fqdnofcollector:5986/wsman/SubscriptionManager/WEC,Refresh=60

my guess is that the cert auth would not be tried after that, and maybe that kerberos is used instead.

but now logs are getting pushed through HTTPS.

1
  • if this is traversing over the internet via HTTPS, and not using a certificate, is the information still encrypted?
    – RAK
    Nov 21, 2023 at 21:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .