You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -18,25 +18,25 @@ When you [create a desktop flow connection using a CyberArk credential](/power-a
18
18
19
19
## Cause
20
20
21
-
The error message occurs because the credential used in the connection can't be authenticated on the target machine you selected.
21
+
The error message occurs because the credential used in the connection can't authenticate on the target machine you selected.
22
22
23
23
## Resolution
24
24
25
-
If you use [Power Automate for desktop installer version](/power-platform/released-versions/power-automate-desktop#all-power-automate-desktop-versions) earlier than 2.50, you can upgrade to version 2.50 or later. After the upgrade, when you create a desktop flow connection using a CyberArk credential, you might see an error message with specific details on what went wrong. The details will give you enough information to solve the problem.
25
+
If you use [Power Automate for desktop installer version](/power-platform/released-versions/power-automate-desktop#all-power-automate-desktop-versions) earlier than 2.50, upgrade to version 2.50 or later. After the upgrade, when you create a desktop flow connection using a CyberArk credential, you might see an error message with specific details on what went wrong. The details will give you enough information to solve the problem.
26
26
27
27
Check the following sections for some specific error messages and their resolutions:
28
28
29
29
## "The configuration for the cyberArk store is incorrect. Validate all connection information."
30
30
31
31
This error occurs because the CyberArk store is misconfigured, and a valid request can't be made for CyberArk.
32
32
33
-
To solve this issue, make sure that the configuration settings in Power Automate match those in CyberArk, including the server address and the application ID. For example, the hostname of the CyberArk server should follow the `https://hostname.com` or `https://hostname.com:443` format. For more information, see [Create a CyberArk credential](/power-automate/desktop-flows/create-cyberark-credential#create-a-cyberark-credential-1).
33
+
To solve this problem, make sure that the configuration settings in Power Automate match those in CyberArk, including the server address and the application ID. For example, the hostname of the CyberArk server should follow the `https://hostname.com` or `https://hostname.com:443` format. For more information, see [Create a CyberArk credential](/power-automate/desktop-flows/create-cyberark-credential#create-a-cyberark-credential-1).
34
34
35
35
## "Could not contact the CyberArk vault. Verify connectivity to the server and validate all connection information."
36
36
37
-
This error occurs due to issues with network connectivity between your machine and the CyberArk server.
37
+
This error occurs because of problems with network connectivity between your machine and the CyberArk server.
38
38
39
-
To solve this issue:
39
+
To fix this problem:
40
40
41
41
- Confirm that your machine can communicate with the CyberArk server.
42
42
- Ensure that the server certificate is trusted by installing it in the [Trusted Root Certification Authorities Certificate Store](/windows-hardware/drivers/install/trusted-root-certification-authorities-certificate-store).
@@ -46,40 +46,63 @@ To solve this issue:
46
46
47
47
This error occurs because the object name doesn't match a CyberArk secret that the configured application can retrieve.
48
48
49
-
To solve this issue,
49
+
To fix this problem,
50
50
51
51
1. Use the [Get accounts API](https://docs.cyberark.com/pam-self-hosted/latest/en/content/sdk/getaccounts.htm?tocpath=Developer%7CREST%20APIs%7CAccounts%7C_____1) to get a list of all the accounts in the Vault.
52
52
1. If no account name matches the object name, update the object name with an existing account, or confirm with your CyberArk team that the application has access to the CyberArk safe that contains the object.
53
53
54
54
## "The CyberArk server was unable to verify the certificate, please confirm that the CyberArk server is correctly configured for SSL authentication."
55
55
56
-
This issue occurs because the CyberArk Central Credential Provider (CCP) might not be correctly set up or configured.
56
+
This problem occurs because the CyberArk Central Credential Provider (CCP) might not be correctly set up or configured.
57
57
58
-
To solve this issue, see [CCP Error APPAP330E Failed to verify application authentication data: Could not obtain client certificate details](https://community.cyberark.com/s/article/CCP-Error-APPAP330E-Failed-to-verify-application-authentication-data-Could-not-obtain-client-certificate-details).
58
+
To fix this problem, see [CCP Error APPAP330E Failed to verify application authentication data: Could not obtain client certificate details](https://community.cyberark.com/s/article/CCP-Error-APPAP330E-Failed-to-verify-application-authentication-data-Could-not-obtain-client-certificate-details).
59
59
60
60
## "Could not read the application certificate. Try to delete and recreate the application."
61
61
62
62
This error message means that the CyberArk certificate can't be processed correctly. The application certificate might be missing, corrupted, or incorrectly installed.
63
63
64
-
This message often appears incorrectly for most errors with Power Automate for desktop versions before 2.50. If you're using a version earlier than 2.50, try an upgrade.
64
+
For most errors, this message appears incorrectly in versions of Power Automate for desktop before 2.50. If you're using a version earlier than 2.50, try an upgrade.
65
65
66
66
Otherwise, [delete](https://docs.cyberark.com/identity/latest/en/content/applications/appsadminportal/appremove.htm) and [re-create](https://docs.cyberark.com/credential-providers/13.0/en/content/common/adding-applications.htm) the application in CyberArk as suggested in the error message. Ensure that you correctly enter the **Application ID**, **Safe**, **Folder**, and **Object** details when [setting up the connection](/power-automate/desktop-flows/create-cyberark-credential#create-a-cyberark-credential-1).
67
67
68
+
## Troubleshoot certificate trust errors
69
+
70
+
If a connection check times out while retrieving credentials from CyberArk, the issue might be related to HTTPS certificate trust. To determine whether an untrusted certificate is causing the problem, you can temporarily configure the [Power Automate service (UIFlowService)](/power-automate/desktop-flows/pad-architecture) to accept untrusted certificates for testing purposes.
71
+
72
+
> [!WARNING]
73
+
> For security, the service accepts only trusted certificates by default. Use the following steps only for testing. After you finish testing, delete the registry entry and restart the service to restore the default behavior.
74
+
75
+
To test for certificate trust issues, follow these steps:
76
+
77
+
1. Open [Registry Editor](~/windows-server/performance/windows-registry-advanced-users.md#use-registry-editor).
1. Create a new **DWORD** value named `AllowUntrustedCyberArkHttpsCertificate`.
83
+
1. Set the value to `1` to allow untrusted CyberArk HTTPS certificates.
84
+
1. Restart the Power Automate service (UIFlowService) to apply the change.
85
+
1. Retry creating the desktop flow connection with the CyberArk credential.
86
+
1. After testing, delete the `AllowUntrustedCyberArkHttpsCertificate` registry entry.
87
+
1. Restart the Power Automate service again to restore the default behavior.
88
+
89
+
If the connection succeeds after you allow untrusted certificates, the root cause is a certificate trust problem. To permanently resolve this problem, install the CyberArk server certificate in the [Trusted Root Certification Authorities Certificate Store](/windows-hardware/drivers/install/trusted-root-certification-authorities-certificate-store) on the target machine.
90
+
68
91
## Other troubleshooting steps
69
92
70
-
If you still don't have enough information to mitigate the issue, here are some steps you can take to troubleshoot the issue:
93
+
If you still don't have enough information to resolve the issue, try the following steps:
71
94
72
-
1.Try using a dedicated action to get a secret from CyberArk in Power Automate for desktop with a local run to validate your configuration.
73
-
1.Try using a browser to get the secret from the target machine with one of the following methods:
95
+
1.Use a dedicated action to get a secret from CyberArk in Power Automate for desktop with a local run to validate your configuration.
96
+
1.Use a browser to get the secret from the target machine by using one of the following methods:
74
97
75
98
- Install the client certificate required for the application on the machine in the user store.
76
99
- Use the following URI in your browser, and select the appropriate certificate to authenticate:
1. If you receive a warning message indicating that the server certificate isn't trusted with one of the methods in step 2, make sure you install the server certificate in the [Trusted Root Certification Authorities Certificate Store](/windows-hardware/drivers/install/trusted-root-certification-authorities-certificate-store).
103
+
1. If you receive a warning message indicating that the server certificate isn't trusted by using one of the methods in step 2, make sure you install the server certificate in the [Trusted Root Certification Authorities Certificate Store](/windows-hardware/drivers/install/trusted-root-certification-authorities-certificate-store).
81
104
82
-
1. Try [changing the Power Automate for desktop service user](/power-automate/desktop-flows/troubleshoot#change-the-on-premises-service-account) to a user who has successfully retrieved the secret with one of the methods in step 2.
105
+
1. Try [changing the Power Automate for desktop service user](/power-automate/desktop-flows/troubleshoot#change-the-on-premises-service-account) to a user who successfully retrieved the secret by using one of the methods in step 2.
0 commit comments