Troubleshooting: Voice and SMS 2FA Fails After Migrating web.config from Another Server

Version Affected: All
 
 

Overview

After a realm's web.config file is copied to a new server, Voice and SMS two-factor authentication (2FA) fails on the new server — even though it continues to work correctly on the original server the file was copied from.

 

Cause

The certificate that the web.config file references, by serial number, either does not exist on the new server, or exists there but was never imported.

Resolution

1. On the original server, in the SecureAuth Admin Console, go to the realm's Sys Info tab and note the serial number shown in the Client Cert Serial Nbr field.
2. Export the certificate with that serial number, including its private key.
3. Import the exported certificate into the new server's certificate store, making sure the private key is set to exportable during the import.
4. Grant the Network Service account Read access to the imported certificate's private key:

• Open the Certificates console and select the imported certificate.
• Right-click it and select All Tasks > Manage Private Keys.
• Click Add, type Network Service, click Check Names, then click OK.
• Select Network Service in the permissions list. Leave Read checked, and make sure Full Control is unchecked.
• Click OK.

This should resolve the issue.
 
 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.