Discovery Performance Decreased After Updating the Code Signing Certificate for JEA - Support and Troubleshooting

Discovery Performance Decreased After Updating the Code Signing Certificate for JEA .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } @font-face { font-family: 'ServiceNow Sans'; src: url('https://www.servicenow.com/etc.clientlibs/ds/clientlibs/clientlib-arc-commons/resources/fonts/ServiceNowSans-Regular.woff2') format('woff2'); font-weight: 400; font-style: normal; font-display: swap; } @font-face { font-family: 'ServiceNow Sans'; src: url('https://www.servicenow.com/etc.clientlibs/ds/clientlibs/clientlib-arc-commons/resources/fonts/ServiceNowSans-Book.woff2') format('woff2'); font-weight: 450; font-style: normal; font-display: swap; } @font-face { font-family: 'ServiceNow Sans'; src: url('https://www.servicenow.com/etc.clientlibs/ds/clientlibs/clientlib-arc-commons/resources/fonts/ServiceNowSans-Medium.woff2') format('woff2'); font-weight: 500; font-style: normal; font-display: swap; } @font-face { font-family: 'ServiceNow Sans'; src: url('https://www.servicenow.com/etc.clientlibs/ds/clientlibs/clientlib-arc-commons/resources/fonts/ServiceNowSans-Bold.woff2') format('woff2'); font-weight: 700; font-style: normal; font-display: swap; } @font-face { font-family: 'ServiceNow Sans Mono'; src: url('https://www.servicenow.com/etc.clientlibs/ds/clientlibs/clientlib-arc-commons/resources/fonts/ServiceNowSansMono-Regular.woff2') format('woff2'); font-weight: 400; font-style: normal; font-display: swap; } :root { --infinite-blue: #032D42; --wasabi-green: #63DF4E; --link-blue: #0968AC; --gray-50: #F9FAFB; --gray-100: #F3F4F6; --gray-200: #E5E7EB; --gray-300: #D1D5DB; --gray-400: #9CA3AF; --gray-500: #6B7280; --gray-700: #374151; --gray-900: #111827; --err: #B42318; --err-bg: #FEF3F2; --success: #067647; --success-bg: #ECFDF3; --font-sans: 'ServiceNow Sans', -apple-system, BlinkMacSystemFont, "Segoe UI", Arial, sans-serif; --font-mono: 'ServiceNow Sans Mono', 'Consolas', 'Monaco', 'Courier New', monospace; --radius-sm: .375rem; --radius-md: .5rem; --shadow-sm: 0 1px 2px rgba(16,24,40,.06); } * { margin: 0; padding: 0; box-sizing: border-box; } body { font-family: var(--font-sans); background: var(--gray-100); color: var(--gray-900); min-height: 100vh; } .topbar { background: var(--infinite-blue); padding: .75rem 0; } .topbar .container { display:flex; align-items:center; justify-content:space-between; } .topbar-badge { font-family: var(--font-mono); font-size: .6875rem; color: rgba(255,255,255,.7); letter-spacing:.02em; text-transform:uppercase; } .container { max-width: 54rem; margin: 0 auto; padding: 0 1.5rem; } .breadcrumb { font-size: .8125rem; color: var(--gray-500); padding: 1rem 0 0; } .breadcrumb a { color: var(--link-blue); text-decoration: none; } .breadcrumb a:hover { text-decoration: underline; } .article-header { background: #fff; border: 1px solid var(--gray-200); border-radius: var(--radius-md); margin-top: 1rem; padding: 1.75rem 2rem; box-shadow: var(--shadow-sm); } .article-type { display:inline-block; font-size:.6875rem; font-weight:700; text-transform:uppercase; letter-spacing:.04em; color:var(--infinite-blue); background:#EAF1F4; padding:.2rem .6rem; border-radius:.25rem; margin-bottom:.85rem; } h1 { font-size: 1.5rem; font-weight: 700; line-height: 1.3; color: var(--gray-900); margin-bottom: 1rem; } .meta-row { display:flex; flex-wrap:wrap; gap: 1.5rem 2.5rem; margin-top:1.25rem; padding-top:1.15rem; border-top:1px solid var(--gray-200); } .meta-item .k { font-size:.6875rem; text-transform:uppercase; letter-spacing:.03em; color: var(--gray-500); font-weight:600; margin-bottom:.2rem; } .meta-item .v { font-size:.875rem; color: var(--gray-900); font-weight:450; } .article-body { background: #fff; border: 1px solid var(--gray-200); border-radius: var(--radius-md); margin-top: 1rem; padding: 2rem; box-shadow: var(--shadow-sm); } .kb-section { padding: 1.75rem 0; border-bottom: 1px solid var(--gray-200); } .kb-section:last-child { border-bottom: none; padding-bottom: .5rem; } .kb-section:first-child { padding-top: .25rem; } h2 { font-size: 1.1875rem; font-weight: 700; color: var(--infinite-blue); margin-bottom: 1rem; display:flex; align-items:center; gap:.5rem; } h2 .num { display:inline-flex; align-items:center; justify-content:center; width:1.5rem; height:1.5rem; border-radius:50%; background: var(--infinite-blue); color:#fff; font-size:.75rem; font-family:var(--font-mono); flex-shrink:0; } h3 { font-size: 1.0625rem; font-weight: 700; color: var(--gray-900); margin: 1.5rem 0 .75rem; } h4 { font-size: .9375rem; font-weight: 700; color: var(--gray-700); margin: 1.15rem 0 .5rem; } p { font-size: .9375rem; line-height: 1.7; color: var(--gray-700); margin-bottom: .85rem; } ul, ol { margin: 0 0 1rem 1.35rem; } li { font-size: .9375rem; line-height: 1.7; color: var(--gray-700); margin-bottom: .4rem; } strong { color: var(--gray-900); font-weight: 700; } code.inline { font-family: var(--font-mono); background: var(--gray-100); border:1px solid var(--gray-200); padding: .05rem .35rem; border-radius: .25rem; font-size: .85em; color: #A4262C; } .log { font-family: var(--font-mono); font-size: .75rem; background: #1E2733; color: #B8C4CE; border-radius: var(--radius-sm); padding: 1rem 1.25rem; overflow-x:auto; line-height:1.7; white-space:pre-wrap; word-break:break-word; margin: .75rem 0 1.15rem; } .log .err { color: #FF8A80; } .log .info { color: #82C7FF; } .callout { border-left: 3px solid var(--gray-300); background: var(--gray-50); border-radius: 0 var(--radius-sm) var(--radius-sm) 0; padding: .75rem 1.1rem; margin: .85rem 0; } .callout-success { border-left-color: var(--success); background: var(--success-bg); } .callout-fail { border-left-color: var(--err); background: var(--err-bg); } .callout-label { font-family: var(--font-mono); font-size: .6875rem; text-transform:uppercase; letter-spacing:.03em; font-weight:700; margin-bottom:.2rem; } .callout-success .callout-label { color: var(--success); } .callout-fail .callout-label { color: var(--err); } .callout p { margin-bottom:0; font-size:.875rem; } table { width:100%; border-collapse: collapse; font-size:.875rem; margin: .5rem 0 1.25rem; } th { text-align:left; background: var(--gray-100); border:1px solid var(--gray-200); padding:.55rem .75rem; font-weight:700; color:var(--gray-900); } td { border:1px solid var(--gray-200); padding:.55rem .75rem; color:var(--gray-700); } td.pass { color: var(--success); font-weight:600; } .applies-to { display:flex; flex-wrap:wrap; gap:.4rem; } .tag { font-size:.75rem; background: var(--gray-100); border:1px solid var(--gray-200); padding:.15rem .55rem; border-radius:9999px; color:var(--gray-700); } .related-list a { color: var(--link-blue); text-decoration:none; font-size:.9375rem; } .related-list a:hover { text-decoration:underline; } .related-list li { margin-bottom:.55rem; } footer { text-align:center; padding: 1.75rem 0 2.5rem; font-size: .75rem; color: var(--gray-500); } .helpful { display:flex; align-items:center; gap:.75rem; margin-top:.5rem; justify-content:center; } .helpful button { font-family: var(--font-sans); font-size:.8125rem; font-weight:500; padding:.45rem 1rem; border-radius:9999px; border:1px solid var(--gray-300); background:#fff; color:var(--gray-700); cursor:default; } .issue-banner { background: var(--err-bg); border:1px solid #FDA29B; border-radius: var(--radius-sm); padding: 1rem 1.25rem; margin-bottom:1rem; } .issue-banner .label { font-family:var(--font-mono); font-size:.6875rem; text-transform:uppercase; letter-spacing:.03em; color: var(--err); font-weight:700; margin-bottom:.35rem; } .issue-banner p { margin-bottom:0; color: var(--gray-900); font-weight:500; font-size: .9375rem; } 1 Issue Title Symptom Discovery against JEA-enabled Windows targets stops classifying hosts immediately after the JEA code signing certificate is renewed on the MID Server, even though the underlying credential tests successfully.

The following errors are observed during Discovery runs:

Could not find any valid credentials to authenticate the target for type [Windows] with credential tag [Discovery_credentialtag] despite the credential passing a standalone Test Credential check. Classification payload is empty. Stopping classification. The MID Server probe/sensor log additionally shows a PowerShell signature failure underneath these surface errors:

DEBUG (PowerConsole-7ad2bf782b768b105c11fe61de91bfbd>stderr) [PowerConsoleStreamGobblerErr:73] STDERR 57aef73c-a8bd-xxxx-xxxx-xxxxxxxx: Exception calling "SignData" with "2" argument(s): "Invalid algorithm specified." DEBUG (PowerConsole-7ad2bf782b768b105c11fe61de91bfbd>stderr) [PowerConsoleStreamGobblerErr:73] STDERR 57aef73c-a8bd-xxxx-xxxx-xxxxxxxx: + FullyQualifiedErrorId : CryptographicException DEBUG (PowerConsole-7ad2bf782b768b105c11fe61de91bfbd>stderr) [PowerConsoleStreamGobblerErr:73] STDERR 57aef73c-a8bd-xxxx-xxxx-xxxxxxxx: EXECUTION_DENIED; error=signature is missing ; script=function printValues{Process{foreach-object{try{$a=$_.Properties}catch{$a=$null}if(-not $a){$a=$_.PsObject.Properties}foreach($p in $a){$o=$p.Name+' : ';if ($p.Value -is [Array]){$o+=[string]::Join(',', $p.Value);}else{$o+=$p.Value;}$o;if($p.Value -is [System.Management.ManagementBaseObject]... The SignData exception and EXECUTION_DENIED; error=signature is missing entries indicate that the JEA-constrained PowerShell session is rejecting the discovery script because it cannot validate the script's signature and not because the credential itself is invalid.

2 Facts (Actual Working) The following configuration items were confirmed to be correctly in place at the time of the issue, ruling out several common causes:

Certificate and JEA package changes made The code signing certificate used for Discovery by JEA was renewed. The new certificate is valid. The relevant certificate(s) were imported into the MID Server's certificate store. The JEAUtils.psm1 module was updated to reference the new certificate. The JEA package deployed to discovered clients was updated accordingly. The certificate was added to the certificate stores on all relevant target servers. Environment and prerequisites verified Prerequisite Status MID Server and target servers are members of the same Windows domain Met JEA credentials (non-administrator) are domain-level credentials Met PowerShell 5.0 / WMF 5.1 installed on target Windows machine(s) Met PowerShell Remoting enabled on target Windows machine(s) Met Because the MID Server and targets share the same domain, all servers are inherently trusted, and a standalone Test Credential against the JEA credential succeeds confirming the credential and domain trust are not the source of the failure.

Configuration gap identified Finding The mid.windows.management_protocol parameter is required for JEA-based Discovery, which must be set to WinRM rather than the default WMI . This was not configured on the MID Server and was added afterward as part of the investigation, since it is required by JEA.

Ruled out KB2941660 (“Discovery via JEA is not working when CNG Certificate is used”) does not apply here. The certificate in this environment used the legacy CSP (Cryptographic Service Provider), not a CNG certificate. Root cause The renewed code signing certificate was issued using the CSP Provider = "Microsoft Enhanced Cryptographic Provider v1.0" . This legacy provider does not support the signature/hash algorithm that the JEA-constrained PowerShell session requires to validate the discovery script's digital signature. As a result, the SignData call fails with Invalid algorithm specified , the script is treated as unsigned, JEA denies its execution ( EXECUTION_DENIED; error=signature is missing ), and Discovery surfaces this as a credential/authentication failure and an empty classification payload.

3 Resolution Reissue the code signing certificate using a CSP that supports the algorithm required by the JEA-constrained session:

Regenerate or reissue the code signing certificate, setting the Cryptographic Service Provider to Microsoft Enhanced RSA and AES Cryptographic Provider (instead of Microsoft Enhanced Cryptographic Provider v1.0 ). Re-import the updated certificate into the MID Server's certificate store, and confirm it is also present in the certificate store on all target servers. Update JEAUtils.psm1 and the JEA package deployed to discovered clients so that both reference the reissued certificate. Confirm the mid.windows.management_protocol MID Server parameter is set to WinRM , since this is required for JEA-based Discovery. Re-run Discovery against the affected Windows targets. Result After reissuing the certificate with the Microsoft Enhanced RSA and AES Cryptographic Provider and confirming the WinRM protocol setting, script signature validation succeeded and Discovery completed successfully on the affected servers.

Why this resolves it Microsoft Enhanced RSA and AES Cryptographic Provider supports the signing/hashing algorithms expected by the JEA-constrained runspace, so SignData completes without error and the script's signature validates. Once JEA accepts the signature, the discovery script executes, credentials authenticate as expected, and classification receives a populated payload instead of stopping early.