Troubleshooting: Passcode App "Invalid Web Address" Error

Version Affected: All
 
 

Overview

When a user tries to add or enroll an account in the SecureAuth Passcode app, on either macOS or Windows, the app can reject the SecureAuth server's web address with an Invalid web address. Try again. error. There are multiple potential causes, distinguished by platform and by what the Passcode log shows:

• See Cause 1 - On macOS, the app cannot negotiate a TLS connection to the server at all
• See Cause 2 - On Windows, the Passcode log shows ERROR SecureAuthOTP.RegistrationWindow - OnAppBrowserNavigateError. Statuscode: -2146697191 even though the URL loads fine in a local browser

These causes are not related, so a fix for one cause will not resolve the other.

 

In this article

• Cause 1: TLS 1.1/1.2 Disabled on the SecureAuth Server (macOS)
• Cause 2: Binding Certificate Doesn't Match or Isn't Trusted (Windows)

Cause 1: TLS 1.1/1.2 Disabled on the SecureAuth Server (macOS)

On a new macOS computer, adding an account in the Passcode app shows:

This happens when TLS 1.1 and/or TLS 1.2 are disabled on the SecureAuth server. Some environments disable these protocols as part of general server hardening, but the Passcode app on macOS requires at least one of them to negotiate a TLS connection with the server. Without it, the app cannot connect and returns this error.

Resolution 1:

Enable TLS 1.1 and/or TLS 1.2 on the SecureAuth server:

1. Open regedit.exe and navigate to:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols.
2. For each protocol you want to enable (TLS 1.1 and/or TLS 1.2), expand its key and select Server (create the Server key if it doesn't already exist).
3. Create or set the following DWORD (32-bit) values under that key:
   • DisabledByDefault = 0
   • Enabled = 1 (0xffffffff)
4. Restart the server for the registry change to take effect.
5. Try adding the account in the Passcode app again.

Cause 2: Binding Certificate Doesn't Match or Isn't Trusted (Windows)

On Windows, enrolling in the Passcode app fails with the same Invalid web address. Try again. error, even though the same URL loads without issue in a local browser. The Passcode log shows:

ERROR SecureAuthOTP.RegistrationWindow - OnAppBrowserNavigateError. Statuscode: -2146697191

For the Passcode app to connect to the enrollment URL, it must trust the certificate bound to that URL and its full certificate chain, and the certificate's subject/SAN must match the URL's address. A self-signed certificate does not satisfy this and will always produce this error.

Resolution 2:

Replace the certificate bound to the site in IIS with one that meets both requirements:

1. Confirm the certificate is issued by a Certificate Authority the Passcode app's device already trusts — not a self-signed certificate.
2. Confirm the certificate's subject or Subject Alternative Name (SAN) matches the enrollment URL's address.
3. In IIS, open the site's bindings and replace the current binding certificate with one that meets both requirements above.
4. Try enrolling in the Passcode app again.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.