3. FAQ - Console Issues

3.1. Certificates and trust

3.1.1. Why is my certificate not trusted by a machine?

When updating the repository, sending a message or adding a package, you may encounter the following error:

EWaptCertificateUntrustedIssuer('Issuer CA certificate CN=XXXX,C=FR can not be found in supplied bundle')

This error indicates that the certificate’s issuing authority cannot be found in the certificates provided for verification.

Show solution

1. Check your personal certificate

In the WAPT Console, open Tools > Preferences and verify the configured Path to personal certificate.

2. Check the trusted certificates on the target machine

Open the Certificates tab in the WAPT inventory and confirm that the certificate or its issuing CA is trusted.

3. Sign the certificate with a trusted CA if necessary

If the certificate is not trusted, create a certificate package and sign it with a certificate already trusted by the target machine.

Follow the certificate signing video guide.

4. Retry the operation

Retry the update, message or package addition.

3.2. Error message about package on the WAPT Console

Error « File setup.py is not allowed in manifest of xxx »

This error means that the certificate currently in use does not have the authority to sign packages.

The only two options available are:

1- Use a different certificate with code-signing rights.

2- Regenerate a certificate by selecting the option code signing (information for build certificate here).

Code signing for certificate

Error when uploading package

Window showing that the uploaded package has signer certificate issue

The WAPT Console shows this error ; Error when uploading package: EWaptForbidden(‘Host matching package UUID_HOST does not trusted signer certificate’).

You have this error when you try to upload a WAPT package but the used certificate which signed package is not present in your computer’s ssl WAPT install location folder. Be reminded, if you have a WAPT Server running on Windows to not lauch the WAPT Console on the server. Add the WAPT certificate which signed the package in your computer’s ssl WAPT install location folder then retry.

Local Error

Window showing that the WAPT Console does not find a package

The WAPT Console shows this error in two situations.

Package does not exist in the repository anymore, yet a host needs it

There are two possible solutions:

• Try to get package anew from Tranquil IT’s store.

• Delete the package from the host dependencies.

OR

When you try to install a package with a locale that is unknown to the host

There are two possible solutions:

• Download the WAPT package having the matching locale from Tranquil IT’s store.

• Edit your WAPT package and set in the control file the option locale with the correct locale (locale=en,fr).

3.3. Opening and connecting to the WAPT Console

3.3.1. Why is my WAPT Console version different from the WAPT Server version?

The WAPT Console and the WAPT Server are running different versions. This may cause compatibility issues.

Show solution

Upgrade the WAPT Console to the same version as the WAPT Server.

3.3.2. Why can’t the WAPT Console connect to the WAPT Server?

The WAPT Console cannot contact the WAPT Server on port 443. This may indicate that the Nginx web service is stopped or unable to start.

Show solution

1. Check whether Nginx is running

On a Linux WAPT Server, run:

systemctl status nginx

2. Restart Nginx if necessary

If Nginx is not running, restart the service:

systemctl restart nginx

3. Check the logs if Nginx fails to start

If the service still does not start, inspect the Nginx logs:

• Linux: /var/log/nginx/

• Windows: C:\Program Files (x86)\wapt\waptserver\nginx\logs

3.3.3. Why is the WAPT Server service unavailable?

The WAPT Server service may be stopped or may have failed to start.

Show solution

1. Check the service status

On a Linux WAPT Server, run:

systemctl status waptserver

2. Start the service if necessary

If the service is stopped, run:

systemctl start waptserver

3.3.4. Why does the WAPT Console report an SSL certificate verification error?

The WAPT Console cannot verify the HTTPS certificate presented by the WAPT Server.

Attention

Before changing any certificate or verification settings, make sure that the error is not caused by a MITM attack.

Show solution

Case 1: The WAPT Server has recently been rebuilt

If you have rebuilt your WAPT Server and use a self-signed certificate, you may be able to recover the previous server’s certificates and keys from:

/opt/wapt/waptserver/apache/ssl

Case 2: Reset the local WAPT Console configuration

Close the WAPT Console and delete the following folder:

%LOCALAPPDATA%\waptconsole

Case 3: Re-enable certificate verification

Run the following command:

wapt-get enable-check-certificate

Make sure the command completes successfully.

Restart the WAPT service:

net stop waptservice && net start waptservice

Finally, restart the WAPT Console.

Case 4: Check the server’s certificate chain

If you do not use certificate pinning, this error may indicate that the certificate presented by the WAPT Server cannot be verified using Python’s certifi certificate bundle. Make sure that the WAPT Server provides the complete certificate chain, including any required intermediate certificates.

3.3.5. Why are all actions disabled in the WAPT Console?

The WAPT Console may appear locked, with all actions greyed out, if the connected user does not have the required permissions.

Show solution

1. Open the WAPT Console as Superadmin

Close the WAPT Console and reopen it using the Superadmin account.

2. Check the user’s permissions

Navigate to:

Tools > Manage Wapt users and rights

Select the affected user and grant the appropriate permissions.

3. Save and reconnect

Save the changes, close the WAPT Console, and reopen it using the user’s usual account.

3.4. Managing the location of machines in WAPT

3.4.1. Why does a machine appear in the wrong Organisation Unit (OU)?

The WAPT Server does not automatically determine the location of a newly deployed machine. The WAPT agent installed on the machine transmits this information to the WAPT Server based on the data available when it communicates with the server.

The machine’s current OU is stored in the following Windows registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Distinguished-Name

Show solution

1. Check the OU known by the machine

In the WAPT Console, identify the machine concerned.

Go to the Hardware Inventory tab.

Look for the computer_ad_dn key. Its value corresponds to the OU that the machine has communicated to the WAPT Server.

2. Update the machine’s Group Policy information

If the value of computer_ad_dn corresponds to the old OU, force the machine to update its Group Policy information.

Via the command prompt:

Run the following command on the machine:

gpupdate /force

Via the WAPT Console:

• Select the workstation concerned.

• Right-click > Windows Computer Management.

• Choose Update AD Group Policies on hosts.

Once the update has been performed, the machine should appear in the new OU in the WAPT inventory.

3.4.2. Why are duplicate or legacy Windows Update KBs displayed in WAPT?

A Windows 11 device running version 25H2 may display cumulative updates intended for earlier releases, such as 22H2, 23H2, or 24H2, in the Windows Updates tab of the WAPT Console.

At first glance, this may suggest that updates for older Windows versions are being installed on the device. Fortunately, this is not the case.

Why does this happen?

Microsoft is aware of this behavior and has acknowledged it in its support forums, although the issue has not yet been resolved.

See the Microsoft discussion.

The information displayed in the Windows Updates tab comes directly from the native Windows Update Agent and is not modified by WAPT.

WAPT intentionally preserves the original data returned by Windows Update so that administrators can work with the information exactly as provided by Microsoft.

While the presence of duplicate or legacy-version KBs can make the update list more difficult to read, this is purely a display issue. It does not affect the update installation process.

Windows Update will only install the cumulative update that matches the operating system version running on the device.

For example, on a Windows 11 25H2 system, only the KB package intended for 25H2 will be installed, even if updates targeting 22H2, 23H2, or 24H2 are also listed in the console.

3.4.3. How can I check which Windows updates are actually installed?

Show solution

To verify which updates are actually installed on a device, run the following PowerShell command:

Get-Hotfix