Agent Registration: Unknown Certificate Issuer – Error 500

Description:

On September 30, 2021, Let’s Encrypt’s previous root certificate [DST Root CA X3] expired.

Let’s Encrypt introduced a new root certificate [ISRG Root X1] in advance. At the same time, a cross-signature for the old root certificate [DST Root CA X3] was implemented to ensure compatibility with older devices that no longer receive updates.

Nevertheless, certificate issues may occur in individual cases.

Symptoms:

Scenario #1 – Update/Installation:

• The automatic update fails with the message «Failed to download the installation file from the management server».
• When installing agent components, the error message «Certificate from URL did not pass the verification» appears.

Scenario #2 – Registration:

• The registration via URL fails with «x509: certificate signed by unknown authority.»

C:\Program Files\BackupClient\RegisterAgentTool>register_agent.exe -o register -cloud -a https://*CUSTOM_URL* -u USERNAME -p PASSWORD  
level=err; message=akk error: Internal server error has occurred, http = .httpCode = 500, .domain = AGENT_CORE, .code = UNKNOWN_CA
Failed
500
    "code" = "UNKNOWN_CA",
    "debug" :
    {
    "msg" : "ensure agent registration: setting up registration state: datacenter discovery: Get https://*CUSTOM_URL*/api/l/accounts?login=USERNAME: x509: certificate signed by unknown authority"
    "domain" : "AGENT_CORE"

Cause:

This challenge affects Windows machines with delayed certificate loading, which occurs when the browser attempts to open the website (https://dl.managed-protection.com/) with the certificate.

Solution:

• Ensure Browser Support:
  • Check if a supported browser is available on the affected machine to access the URL https://dl.managed-protection.com/. A browser that can successfully load the certificate is crucial.
• Use Another Machine:
  • Use a supported browser on another machine.
  • Open the URL https://dl.managed-protection.com/ from the other machine.
  • Download the required certificate.
  • After downloading on the other machine, transfer the certificate to the affected machine.
  • Manually import the downloaded certificate on the affected machine.

By applying one of the solutions above, the certificate should load successfully and enable agent registration without further issues.

Do you have questions or comments about this help center article? Please don’t hesitate to contact us. We’re happy to help and appreciate your feedback!

Aktualisiert am 30. Juni 2025