AirWatch Code Signing CA Expired

[AnotherRandSA]

This morning I restarted our on-prem AirWatch server while diagnosing Tunnel issues. After the server came back online, only 4 VMware/AirWatch services began running, all others failed.

The failure reasons given in Event Viewer indicated there was a trust issue with the DLLs, so I checked the DLLs Digital Signatures and found the AirWatch Code Signing CA expired this morning (2023/08/08 6:20:45 AM).

It appears to be the same issue previously documented here: https://kb.vmware.com/s/article/82369

[troysp · Accepted solution]

Same issue here.  Found this article but the zip file does not contain signtool.exe so the script fails for me.

SINST-176145 - Multiple Workspace ONE UEM application pools and services may not start once stopped ...

[troysp]

Never mind, they updated the zip file and now it contains the correct files.  Went from version 4 to version 4.1.  LOL

[AnotherRandSA]

I just downloaded the linked zip and it contains signtool.exe, FWIW.

[AnotherRandSA]

They're scrambling.

[troysp]

Yep

[AnotherRandSA]

Certs updated OK using the signing utility. Services came back up. Still some problems in our install, but not sure if they're related to this specific issue.

[Rienus]

Has anyone else noticed that the dll's and executables for the horizon connection brokers are also signed with expiring certificates. these will expire on 12th of august

[SHAUNCHAN]

we are currently running an older ver (soon to upgrade/update) but i feel like the patch is dead in the water for us old ver folks.

I have the UEMDllSigningUtility.zip > ran the PS .. no dice on our end.

hoping someone has some directions. (and of course i'm in the middle of renewing my support contract, so i can't even submit a tkt)

any direction from anybody, I really appreciate it.

[Phil_Helmling]

Shaunchan you should contact your local VMware partner or rep and ask to be put on the "do not block" support list. You will likely need to prove you are renewing and therefore entitled to the upgade, then upgrade.

[Adamfry]

Had the same, ran the DLL patch on DS and console servers and the Airwatch services on both are now all running but the console webpage is not loading (503 not available)

Going to fiddle and then raise a ticket if cannot sort it.  We are on 2102

[Adamfry]

Was an issue with application pool on IIS, needed to repair some IIS services and add on modules.  Console working again so going to check everything else.  Devices are checking in..

[SHAUNCHAN]

yes IIS POOL apps are not starting as well.... i'm on 2105.

Adam - can I DM  you my friend 🙂

[SHAUNCHAN]

@Phil_Helmling 

Yeh i've reached out to my acct rep: ghost replies as usual... 

[Adamfry]

Yeah no worries, will try and help if can. I did the DLL bits, no errors and the Airwatch services all started ok but had to get one of our geniuses to find/sort the IIS so will try and get a steer about that.

[Adamfry]

Did your DLL updater work without errors and services start again ?

Got this info back from colleague to fix IIS, hopefully helps:

I re-installed the IIS Rewrite Module, Visual C++ redistributable, and the .net core hosting bundle

Snapshot/backup of course 😉

[SHAUNCHAN]

@Adamfry 

when i rean the PS script, had a bunch of errors 😞

Pool app wise, Airwatch DS and the Airwatch did not start ....

[Rienus]

VMware states that there is no issue with horizon on this issue

[Adamfry]

Hmmmmm, I think the ReadME said if you get errors try running the script again.  I guess until you get no errors but if you still get them then maybe have to be support if you can get a ticket raised 😞

[SHAUNCHAN]

@Adamfry 

Yeh, ran it a few times already.

maybe i'm not running it in the right root folder ? 

UPDATE: i just moved the script/folder to the "Airwatch 2105" folder....

i'm going to keep running it ... tons of errors but looks like i'm SOL atm