Contents

Introduction

Problem

Solution

Related Information

Introduction

This document describes how to resolve "Posture Registration Error. Failed to Register with Duo Desktop".

Problem

When a user tries to enroll in ZTA, the error is printed in the Cisco Secure Client notification popup:

Posture Registration Error. Failed to Register with Duo Desktop.

To check the issue, verify the logs based on the next steps:

- Open Duo Desktop > Settings > Preferences Button

- Enable Detailed Diagnostic reports

Note: You can also refer to How do I enable and view debug logs for Duo Desktop

Replicate the issue and then run the DART (Diagnostic And Reporting Tool).

- Open Secure Client

- Click on Diagnostics

Cisco Secure Client - Generate DART

- Continue with the wizard; do not modify the Default option to gather all the information

Generating DART

The bundle logs after that are on your Desktop.

- Under the DART file, access to Cisco Secure Client > Zero Trust Access > Logs

- Open ZeroTrustAccess.txt

The ZTNA error is in the next log:

- (DHA 'DhaRequestEnrollment' failure response reported error : 'Unable to sign health payload')

ZTA - Error logs

The bundle logs after that are on your Desktop.

- Under the DART file, access to Cisco Secure Client > Duo Desktop > DHA_Logs

- Open DuoDeviceHealth.log

The Duo Desktop error is in the next log:

- (ERROR|DuoDeviceHealthLibrary.Utilities.Services.ServerCertificateService|Invalid server certificate found; not in pinned list (11))

Duo Desktop - Error Logs

Error "Invalid server certificate found; not in pinned list"  In Duo Desktop, there is an incorrect certificate that was used as a result of traffic inspection, decryption, or proxying.

For more information, check How do I resolve the debug log error "Invalid server certificate found; not in pinned list" in Duo Desktop?

Solution

- Ensure that *.duosecurity.com is listed as an exception in any SSL decryption/inspection/injection, proxying, or firewall infrastructure in your environment or Secure Access.

- Ensure that sseposture-routing-commercial.k8s.5c10.org  is listed as an exception in any SSL decryption/inspection/injection, proxying, or firewall infrastructure in your environment or Secure Access.

- Ensure that sseposture-routing-commercial.posture.duosecurity.com  is listed as an exception in any SSL decryption/inspection/injection, proxying, or firewall infrastructure in your environment or Secure Access.

Related Information

- Secure Access UserGuide

- Cisco Technical Support & Downloads