- Overview
- Reference Guide
- Setup & Architecture
- Release Notes
- Workflow
- API Reference
- Integration Guide
- Discovery Agent Setup Guide
Renewal Manager Troubleshooting
This section helps you find and fix common Renewal Manager problems: the agent service not starting after installation, the agent host being unable to reach target servers, and renewals that fail. It also explains where to find the agent log when you need more detail.
Installation Errors
- The Windows account used to install the Renewal Manager service needs two local rights: Log on as a service and Log on as a batch job.
- If either right is missing, the service can still install but fails to start, usually with Service Control Manager error 1069 ("The service did not start due to a logon failure.").
How to Check
- Run secpol.msc on the agent host.
- Go to Security Settings → Local Policies → User Rights Assignment.
- Open Log on as a service and Log on as a batch job. Confirm the service account is listed in both.
Command-line alternative (also run on the agent host):
secedit /export /cfg C:\secpol.cfg
findstr /i "SeServiceLogonRight SeBatchLogonRight" C:\secpol.cfgCompare the SIDs this prints against the service account's own SID.
Good to know: On a domain-joined machine, these rights are sometimes enforced by Group Policy instead of local policy. If they are missing locally and you cannot add them, check with your AD team before changing anything.
Renewal Manager Connectivity Errors
Every target server must be reachable from the Renewal Manager agent host on the right ports before it can be scanned or renewed.
| What | Port |
|---|---|
| WinRM (Windows targets) | TCP 5985 |
| SSH (Linux targets, and Apache/Nginx/Tomcat hosted on Linux) | TCP 22 |
| The application endpoint itself | 443, 8443, 1433 (MSSQL), 27017 (MongoDB), the Oracle listener port, etc. |
| The management interface of API-managed targets: api.cloudflare.com for Cloudflare, the Primary Admin Node for Cisco ISE, the APIC for Cisco ACI, the SBC web interface for AudioCodes, the firewall or Panorama for PAN-OS | HTTPS: 443 for Cloudflare, Cisco ISE, and Cisco ACI. For AudioCodes, 443 unless the SBC Web Port is set to another port. |
Commands (PowerShell) to Check, Run from the Agent Host
-
Port only: confirms the network path is open, nothing more.
Test-NetConnection -ComputerName <target> -Port 5985 -
WinRM itself: confirms WinRM is actually listening and answering, not just the port.
Test-WSMan -ComputerName <target> -
SSH itself: confirms a real login works, not just the port.
ssh <user>@<target>
If WinRM still fails after the port and Test-WSMan both succeed
- Check that the target's IP is in the agent host's trusted hosts list: winrm get winrm/config/client, look for TrustedHostsList.
- Confirm the target's firewall allows the specific application port too (443/1433/27017/etc.). Opening WinRM does not open that port.
Renewal Errors
- Manual and scheduled renewals: check that server's task status in the UI. Right-click the server in Renewal Manager → View Tasks.
- Automated (unattended) renewals: check Misc → Logging → Renewal Manager tab instead. This tab shows detailed automated scan/renewal activity for automated renewals.
Messages When a Renewal Cannot Be Queued
| Message | What it means | What to do |
|---|---|---|
| Renewal Manager is offline. Cannot queue task. | A manual or scheduled renewal, or a Push Certificate, was requested while the Renewal Manager is offline. | Check the Status at the top of the Renewal Manager page and the EC_Renewal_Manager service on the agent host, then try again. |
| Automated renewal is on for this endpoint - turn automation off to renew it manually or schedule a renewal | Automation is on for that endpoint, so it is renewed by the Renewal Manager itself. Renew is also unavailable in its row menu. | Switch automation off for the endpoint with Manage Automation, or leave it to renew automatically. |
| The installed Renewal Manager does not support automated renewal of '<type>' endpoints yet - update it, then try again | Automation was requested for a target type that the installed Renewal Manager version does not report support for. | Update the Renewal Manager, then try again. |
For Cisco ISE and Cisco ACI servers, View Tasks shows a short hint under the details of many failed tasks. The hint explains the usual cause and what to change. The Cisco ISE hints are listed on the Cisco ISE page.
Agent Log Folder
- The agent's own logs folder (inside its install directory, path set in conf.ini under [LOGGING] LOGDIR) records every action it takes, success or failure, in full detail.
- The file is named Renewal Manager.log and rotates automatically once it passes the configured size.
- When the UI and the task/log views do not have enough detail to explain a failure, this file is the next place to look.