Forum Discussion
Problem after SSL certificate expired
The error message indicates that there's an issue with the SSL/TLS certificate validation when establishing the connection to the PBIRS server. This can happen if the new SSL certificate is not trusted or if there are certificate chain issues.
Here are some steps you can take to troubleshoot and resolve the issue:
Verify SSL Certificate Installation: Double-check that the new SSL certificate is installed correctly on the PBIRS server. Ensure that the certificate is valid, not expired, and matches the server's hostname.
Check Certificate Chain: Make sure that the SSL certificate chain is configured correctly. The certificate chain should include all necessary intermediate and root certificates to establish trust. You can use tools like OpenSSL to inspect the certificate chain.
Ensure Proper Binding: Verify that the new SSL certificate is properly bound to the PBIRS website in IIS. Check the bindings for both the Web Portal and Web Service endpoints to ensure they are using the correct SSL certificate.
Update Trusted Root Certificates: Ensure that the client machine accessing the PBIRS server has the updated trusted root certificates. Sometimes, outdated root certificates can cause SSL/TLS validation errors. You may need to update the root certificates on the client machine.
Check Firewall and Proxy Settings: Make sure that there are no firewall or proxy settings blocking the SSL/TLS connection between the client and the PBIRS server. Ensure that the necessary ports (e.g., 443 for HTTPS) are open and accessible.
Review TLS Configuration: Verify the TLS configuration on the PBIRS server and client machines. Ensure that both are configured to use a compatible version of TLS (e.g., TLS 1.2) and that any deprecated versions (e.g., SSL 3.0) are disabled.
Enable Detailed Error Logging: Increase the logging level for PBIRS to capture more detailed error messages. This can help identify the specific cause of the SSL/TLS validation error.
Consult IT Security: If you're still unable to resolve the issue, consider consulting your organization's IT security team or a qualified SSL/TLS certificate expert for further assistance. They may be able to provide additional insights or guidance on resolving certificate-related issues.
Did I answer your question? Mark my post as a solution! Appreciate your Kudos !!
Hi, I have verified the SSL certificate, certificate chain, and the binding. The issue that I am running into is only occurring with Power BI reports. I am able to open SSRS reports/etc without any issues. It's also only occurring when viewing the site using HTTPS. If I use HTTP, I am able to open Power BI reports with no issues. I tested accessing both the /Reports and /ReportServer URLs and I can see that they both use the new SSL certificate. It looks like the service that PBIRS uses to display the Power BI reports is still holding on to the old (expired) certificate for some reason.
have you restarted that service/server ?
Yes, I did restart both the service and server multiple times. I even uninstalled, rebooted the server, re-installed and still ran into the same issue. I have since managed to resolve the issue, although I'm not sure what the fix exactly was. I was trying a few things and I added a host header on the HTTP binding. I'm not sure why exactly that would have changed anything, but since I did that, I no longer get the error that I was getting before (The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel. ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure.)
