Snow Inventory Agent cannot send .snowpack files with "Handshake failed" error

Snow Inventory Agents or clients may be unable to send .snowpack or .inv files to the Snow Inventory Server even though the Snow Inventory test page loads successfully and snowagent.exe test completes successfully.

The agent log may contain errors similar to:

yyyy-mm-ddThh:mm:ss-5:00; WARNING; snowagent; client\configmessagehandler.cpp; Client::ConfigMessageHandler::SendToEndpoint; A http send error occured with endpoint http://%Customer_SnowInventory_Site%/inventory.asmx. HTTP send error.: The operation timed out

yyyy-mm-ddThh:mm:ss-5:00; ERROR; snowagent; client\messageloop.cpp; Client::MessageLoop::Handshake; Handshake failed. Cannot connect to server. No endpoint can establish a connection to the server.

Successfully opening the Snow Inventory test page confirms that a basic browser request can reach the server, but it does not confirm that the Snow Inventory Agent can complete the handshake or upload a snowpack. The browser normally runs under the logged-in user account, while the Snow Inventory Agent usually runs as Local System. These identities may use different proxy settings, authentication methods, and security policies.

This article applies to Snow Inventory 25.x.x or later and Snow License Manager 25.x.x.

Solution

Test the connection under the Local System context. Also check the WinHTTP proxy configuration by running:

netsh winhttp show proxy

Review the Windows System event log for Schannel errors and collect verbose output by running:

snowagent.exe send -v

If a load balancer, proxy, web filter, firewall, or TLS-inspection device is present, confirm that it permits:

POST requests
The required content length
Sufficient upload timeouts
Sufficient idle timeouts

A device may allow the Snow Inventory test page to load while still blocking or terminating snowpack uploads. Where possible, test the agent directly against the Inventory Server to bypass intermediary devices and isolate the affected component.

Test the Snow Inventory page load time

Close all browser sessions.

NOTE: This test must be performed with a clean browser session. The test checks the initial response and handshake from Snow Inventory and how long the page takes to load.
Open the browser, browse to the Snow Inventory test page, and note how long the page takes to load.
- If the page loads quickly, in the expected amount of time, the problem is typically a Layer 5 device such as a proxy, load balancer, or web filter such as Websense or Barracuda.
- If the page takes more than approximately 15 to 60 seconds to load, the problem is typically related to client-side certificate negotiation being enabled.
- If the page takes more than 60 seconds to load, the problem is typically related to the Local System setting for Server Certificate Revocation.

If the test page loads quickly

The problem is typically related to a Layer 5 device such as a proxy, load balancer, or web filter such as Websense or Barracuda.

Typically, the Active Directory account in use is cleared for traffic across the Layer 5 device. This is why the browser works when it is launched using that user account. However, the Snow Inventory Agent typically runs using the Local System account. This account may not have the security requirements needed to initiate the handshake or send .snowpack files to the Snow Inventory system.

Determine which account the Snow Inventory Agent service uses:
1. Open Services.msc.
2. Locate the Snow Inventory Agent service.
3. Check the account listed in the Log On As column.
To test whether this is the problem, change the account used by the Snow Inventory Agent service to an account that is cleared through the device. Typically, use the same account that can access the Snow Inventory test page.
1. In Services.msc, right-click the Snow Inventory Agent service and select Properties.
2. Select the Log On tab.
3. Select This account, and then click Browse.
4. Locate the account to use in Active Directory, and click OK.
5. Most likely, the new account will have log on as a local service added. Click OK.
6. Restart the Snow Inventory Agent service.
7. In Services.msc, verify that the Snow Inventory Agent service is now logged on using the new account.
Use an elevated Command Prompt to test sending a .snowpack file:
1. Open Command Prompt as administrator.
2. Navigate to the Snow Inventory Agent working directory:
```
cd %Snow_Agent%
```
3. Run:
```
SnowAgent send
```
If the send succeeds, create a service account for the agent and give the account access through the proxy.

For more information about service logon accounts, see Service Logon Accounts.

If the test page takes between 10 and 60 seconds to load

Client-side certificate negotiation may be enabled.

On the Snow Inventory system, open Command Prompt as administrator and run:
```
netsh http show sslcert
```
The result will look similar to the following:
Note the IP address and port number. They should match the values required for Snow Inventory.
If the system has more than one SSL/TLS certificate, locate the correct certificate using the Local Computer Certificates MMC snap-in.
In the command output, verify that the certificate bound to the following Snow Inventory application ID is listed with client certificate negotiation disabled:
```
{0ca478a6-87af-4de7-84d4-425ec03c6b9d}
```

If it is not disabled, rebind the certificate:

Delete the existing certificate binding:

netsh http delete sslcert ipport=%whatever is listed on IP:Port line%

Rebind the certificate:

netsh http add sslcert ipport=0.0.0.0:60000 certhash=%customer_Certificate_Has% appid={0ca478a6-87af-4de7-84d4-425ec03c6b9d} clientcertnegotiation=disable

The Snow Inventory application ID is {0ca478a6-87af-4de7-84d4-425ec03c6b9d}.

For more information about the netsh command, see Netsh Command Syntax, Contexts, and Formatting.

If the test page takes more than 60 seconds to load

The problem is typically related to Server Certificate Revocation.

Determine the issuer of the SSL/TLS certificate.

To do this, open MMC and select Computer account when prompted for the Certificate snap-in. See the Configure the Local Computer Certificates MMC snap-in section below.
Review the certificate in the Local Computer Certificates MMC snap-in and locate the addresses of the Certification Authority (CA) and Certificate Revocation List (CRL) points.
Provide a network path to the CA so that the certificate can check for revocation. This is the more secure option.
Alternatively, disable the revocation check. This is the less secure option.

Go to Tools > Internet Options > Advanced. The following two options control revocation checking:
- Check for server certificate revocation: Controls whether revocation checks occur for HTTPS connections.
- Check for publisher's certificate revocation: Controls whether revocation checks occur when validating Authenticode digital signatures on downloaded programs and ActiveX controls.

For more information about certificate revocation checks, see Understanding certificate revocation checks.

NOTE: Disabling the check requires a reboot of the Snow Inventory system.

Configure the Local Computer Certificates MMC snap-in

Press Windows+R to open the Run dialog, enter MMC, and press Enter.
In the MMC console, select File > Add/Remove Snap-in.
In the Add or Remove Snap-ins window, select Certificates, and click Add.
Select Computer account, and click Next.
Select Local computer, and click Finish.
Verify that the snap-in is listed as Local Computer, and click OK.
The MMC console should now display the Local Computer certificate stores.

Was this helpful?

Product

Snow Inventory Server

Version

26.x;25.x

Visibility

Guest

URL Name

AbletobrowsetoSItestpagebutcannotsendthesnowpackErrorinlogsstatehandshakefailed-v2