Troubleshooting: Problems Running SISU (SecureAuth Installation Setup Utility)

Version Affected: All

Overview

SISU (the SecureAuth Installation Setup Utility) fails to complete, or stalls, during installation. There are several unrelated causes, so a fix for one cause will not resolve the others:

See Cause 1 - SISU fails during the Update93Components step because the required .NET Core components are not installed
See Cause 2 - SISU fails during the Update93Components step because the World Wide Publishing Service (W3SVC) is turned off
See Cause 3 - The installer stalls after downloading the license and certificate because the SecureAuth.zip file has already been downloaded
See Cause 4 - SISU throws "Could not establish a connection to the Internet" because outbound TCP 80/443 is blocked from the IdP server
See Cause 5 - Certificate generation fails with "Object reference not set to an instance of an object" due to an extra comma in a profile field

DEBUG: Calling GetResource from the following assembly: D:\SecureAuth\SecureAuth0\bin\MFC.SecureAuth.License.dll
ERROR: Update93Components: System.Net.Http.HttpRequestException: Could not parse SecureStorage API response ---> Newtonsoft.Json.JsonReaderException: Unexpected character encountered while parsing value: <. Path '', line 0, position 0.
at Newtonsoft.Json.JsonTextReader.ParseValue()
at Newtonsoft.Json.Linq.JObject.Load(JsonReader reader, JsonLoadSettings settings)
at Newtonsoft.Json.Linq.JObject.Parse(String json, JsonLoadSettings settings)
at SA.Common.WebConfig.JsonApiClient.CreateSecureStore(String baseSecureStoreUri)
--- End of inner exception stack trace ---
at SA.Common.WebConfig.JsonApiClient.CreateSecureStore(String baseSecureStoreUri)
at SA.Common.WebConfig.WebConfigUpdater.UpdateSecureStoreApiConnections(String baseUrl)
at SecureAuthIdPSetupUtility.Configurer.UpdateAppSettings()
ERROR: error during preinstallation Could not parse SecureStorage API response
DEBUG: Exception caught during installation: Could not parse SecureStorage API response

Reviewing the SecureStorageApi endpoints in the IIS log shows HTTP 500 status codes being returned.

Alternatively, reviewing the IIS logs directly (rather than the SISU Debug log) for the same underlying cause shows HTTP 500.19 errors instead.

In both cases, the underlying cause is the same: the required .NET Core components are not installed on the appliance.

Resolution 1:

Install the .NET Core components required for your Identity Platform version, per the SecureAuth Compatibility Guide.

If .NET Core is not present in Programs and Features, it can also be installed manually via .NETCore2HostingComponents, found in the SISU installation path. A server with highly restricted outbound internet access is a common reason .NET Core did not get installed automatically during SISU, and can require this standalone installation instead.

Cause 2: World Wide Publishing Service (W3SVC) Turned Off

SISU shows "Update93 unable to connect to the remote server". This happens when the World Wide Publishing Service (W3SVC) is turned off, which means IIS is not available for SISU to continue — SISU does not start IIS on its own.

Resolution 2:

Turn on the World Wide Publishing Service (W3SVC) in Windows Services, then run SISU again.

Cause 3: SecureAuth.zip Already Downloaded

The installer downloads the license and certificate successfully, then stalls. After downloading the license and certificate, SISU tries to download SecureAuth.zip — if that file was already downloaded previously and placed in D:\MFCApp_Bin\SISU\Download, the installer errors out because the file it is trying to download already exists in the location it wants to place it.

Resolution 3:

Instead of resetting the activation key and starting over, simply rerun SISU after it fails — it completes successfully on the second attempt.

Cause 4: Outbound Internet Access Blocked

SISU shows "Could not establish a connection to the Internet" on the activation screen, immediately after entering the 25-character activation code.

SecureAuth IdP Setup Utility activation screen showing the error Could not establish a connection to the Internet below the activation code field.

This happens because the SecureAuth Installation Setup Utility requires outbound access on TCP ports 80 and 443 from the IdP server during installation.

Resolution 4:

Confirm the IdP server can reach the internet over HTTP and HTTPS. This may require involving your Networking or Infrastructure team to allow outbound HTTP and HTTPS traffic from the SecureAuth servers.

Cause 5: Extra Comma in a Profile Field Breaks Certificate Generation

The SISU log shows ERROR: Generate Certificate Exception: Object reference not set to an instance of an object., immediately after a GetCertificate - subjectDN: debug line.

This happens when a comma inside one of the values that make up the certificate request's subject Distinguished Name (DN) is misread as an extra Relative Distinguished Name (RDN) separator. A valid certificate request expects a specific number of RDNs; the extra comma adds one more than expected, and certificate generation fails. For example, a title value like Senior Manager, Security Engineering contains a comma that splits it into two RDNs instead of one.

Resolution 5:

Review the subjectDN line in the SISU debug log immediately before the error, and count its RDNs. If one of the values contains an embedded comma, edit that value -- in whichever account or profile record it comes from -- to remove or replace the comma, then retry certificate generation.

Special Considerations

Separately from any of the causes above, you may find two or more SecureAuth certificates with the same name in the Certificates console. Before deleting any that appear unused, check the License Info section, Global Settings, and SecureStorage to confirm they are genuinely not in use.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.