Administration

Table 5‑8. Broker to Enrollment Server Connection Status
Status Text Description
Failed to fetch True SSO health
information.
The dashboard is unable to retrieve the health information from the broker.
The <FQDN> enrollment server
cannot be contacted by the True SSO
configuration service.
In a POD, one of the brokers is elected to send the configuration information to all
enrollment servers used by the POD. This broker will refresh the enrollment server
configuration once every minute. This message is displayed if the configuration task has
failed to updated the enrollment server. For additional information, see the table for
Enrollment Server Connectivity.
The <FQDN> enrollment server
cannot be contacted to manage
sessions on this connection server.
The current broker is unable to connect to the enrollment server. This status is only
displayed for the broker that your browser is pointing to. If there are multiple brokers in the
pod, you need to change your browser to point to the other brokers in order to check their
status. For additional information, see the table for Enrollment Server Connectivity.
Table 5‑9. Enrollment Server Connectivity
Status Text Description
This domain <Domain Name> does
not exist on the <FQDN> enrollment
server.
The True SSO connector has been configured to use this enrollment server for this
domain, but the enrollment server has not yet been configured to connect to this domain. If
the state remains for longer than one minute, you need to check the state of the broker
currently responsible for refreshing the enrollment configuration.
The <FQDN> enrollment server's
connection to the domain <Domain
Name> is still being established.
The enrollment server has not been able to connect to a domain controller in this domain.
If this state remains for longer than a minute, you might have to verify that name resolution
from the enrollment server to the domain is correct, and that there is network connectivity
between the enrollment server and the domain.
The <FQDN> enrollment server's
connection to the domain <Domain
Name> is stopping or in a problematic
state.
The enrollment server has connected to a domain controller in the domain, but it has not
been able to read the PKI information from the domain controller. If this happens, then
there is likely a problem with the actual domain controller. This issue can also happen if
DNS is not configured correctly. Check the log file on the enrollment server to see what
domain controller the enrollment server is trying to use, and verify that the domain
controller is fully operational.
The <FQDN> enrollment server has
not yet read the enrollment properties
from a domain controller.
This state is transitional, and is only displayed during startup of the enrollment server, or
when a new domain has been added to the environment. This state usually lasts less than
one minute. If this state lasts longer than a minute, either the network is extremely slow, or
there is an issue causing difficulties accessing the domain controller.
The <FQDN> enrollment server has
read the enrollment properties at least
once, but has not been able to reach a
domain controller for some time.
As long as the enrollment server reads the PKI configuration from a domain controller, it
keeps polling for changes once every two minutes. This status will be set if the domain
controller (DC) has been unreachable for a short period of time. Typically this inability to
contact the DC might mean the enrollment server cannot detect any changes in PKI
configuration. As long the certificate servers can still access a domain controller,
certificates can still be issued.
The <FQDN> enrollment server has
read the enrollment properties at least
once but either has not been able to
reach a domain controller for an
extended time or another issue exists.
If the enrollment server has not been able to reach the domain controller for an extended
period, then this state is displayed. The enrollment server will then try to discover an
alternative domain controller for this domain. If a certificate server can still access a
domain controller, then certificates can still be issued, but if this state remains for more
than one minute, it means the enrollment server has lost access to all domain controllers
for the domain, and it is likely that certificates can no longer be issued.
View Administration
VMware, Inc. 111