PENDING MECM Software Center Can't See Apps Deployed to User Collections

[OregonSteve]

MECM Ver. 2403 Single Server
Hi- Everything was working as expected until my Network Services department did some config changes to the network. That was two weeks ago. Ever since I cannot see apps in Software Center that have been deployed to Users or User Collections. Any new clients don't see any apps that have been previously deployed. I've checked the SSL cert for the web server and the clients. As far as I can tell, are all valid.

The only error I can see in the SCClient_XXX.log file is the following:
GetApplicationsAsync: Could not establish trust relationship for the SSL/TLS secure channel with authority '<mecm.server.com>'.. Unable to fetch user categories, unknown communication problem.

Any guidance is greatly appreciated!

Kindest Regards
OregonSteve
"Never never doubt what nobody is sure about." -Willy Wonka

 

[stuntguy3000]

What were the network changes? Can you use a tool like sslyze from a client to attempt the TLS connection (to validate)?

 

[OregonSteve]

What were the network changes? Can you use a tool like sslyze from a client to attempt the TLS connection (to validate)?

I was just told by our Network Services that no changes were made to any protocols or ports. Could you share with me info on how to test the TLS connection? I've done quite a bit of Googling and the only results I find are how to enable it.

Thanx
OregonSteve
"Never never doubt what nobody is sure about." -Willy Wonka

 

[OregonSteve]

OK, I found sslyze and this is the output related to TLS 1.2:

TLS 1.2 Cipher Suites:
Attempted to connect using 156 cipher suites.

The server accepted the following 15 cipher suites:
TLS_RSA_WITH_AES_256_GCM_SHA384 256
TLS_RSA_WITH_AES_256_CBC_SHA256 256
TLS_RSA_WITH_AES_256_CBC_SHA 256
TLS_RSA_WITH_AES_128_GCM_SHA256 128
TLS_RSA_WITH_AES_128_CBC_SHA256 128
TLS_RSA_WITH_AES_128_CBC_SHA 128
TLS_RSA_WITH_3DES_EDE_CBC_SHA 168
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 256 ECDH: secp384r1 (384 bits)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 256 ECDH: secp384r1 (384 bits)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA 256 ECDH: secp384r1 (384 bits)
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 128 ECDH: prime256v1 (256 bits)
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 128 ECDH: prime256v1 (256 bits)
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA 128 ECDH: prime256v1 (256 bits)
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 256 DH (2048 bits)
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 128 DH (2048 bits)

The group of cipher suites supported by the server has the following properties:
Forward Secrecy OK - Supported
Legacy RC4 Algorithm OK - Not Supported

Thanx
OregonSteve
"Never never doubt what nobody is sure about." -Willy Wonka

 

[stuntguy3000]

Is the certificate actually valid and trusted by your endpoints? (Can you load it in a browser?)

 

[OregonSteve]

Yes...Windows Server IIS splash page loads.

Thanx
OregonSteve
"Never never doubt what nobody is sure abourt." -Willy Wonka