Client validation failed

TABLE OF CONTENTS

• 1. Symptoms in Ivanti and the five(9)s Console
• 2. Cause of the Client Validation Failure
• 4. Resolving the Issue
• 5. Helpful Links

1. Symptoms in Ivanti and the five(9)s Console

A failed client validation is visible in Ivanti and the five(9)s Console and it restricts the usability of both.

Effects in Ivanti

When selecting a device, Ivanti attempts to gather feedback, such as whether the device is online or whether the remote control service is available. If this agent feedback is not displayed for an online device or takes up to 20 seconds to appear, follow the instructions described in this document.

Effects in the five(9)s Console

When a device is selected, you might see "Client validation failed" next to the online indicator. The client validation ensures that the correct agent is responding. If it is unsuccessful, some console actions, such as Custom Buttons, cannot be used.

2. Cause of the Client Validation Failure

Ivanti is increasing the security level for Endpoint Manager. To ensure only code from Ivanti can be executed through the agent on managed devices, all DLLs and executables inside the EPM Agent are digitally signed with a code signing certificate of DigiCert.

In EPM 2020.1, the digital signature in the file, which is signed with a 3rd party code signing certificate, became the “primary” validation, with .sig file as the backup. In 2021.1, the .sig files are gone, and the digital signature is the only option to validate the files.

When Ivanti EPM and five(9)s console access the client to validate the correct agent, the new certificate check will take place: 

On a regular basis Windows (responsible for the OCSP flow) validates if the EPM certificate was revoked for some reason. To do this, a DigiCert Certification Service (WEB PKI) will be contacted, which is hosted by the Akamai Content Delivery Network.

In some scenarios (VPN, special Networks, Proxy Settings, ...) this PKI infrastructure is not reachable.

This might cause delays up to 20 sec in the certificate validation process.

3. Checking DigiCert Connectivity

Perform the following PowerShell script on the affected device

# List of DigiCert CRL URLs (adjust as needed)
# Source for list: https://knowledge.digicert.com/alerts/digicert-certificate-status-ip-address

$crlUrls = @(
    "crl3.digicert.com",
    "crl4.digicert.com",
    "cdp.thawte.com",
    "cdp.geotrust.com",
    "cdp.rapidssl.com",
    "cdp1.digicert.com",
    "cdp1.public-trust.com",
    "cdp2.digicert.com",
    "cdph.digitalcertvalidation.com",
    "crl.digicert-cn.com",
    "crl.edge.digicert.com",
    "crl.pki.abb.com",
    "ocsp.digicert.com",
    "status.thawte.com",
    "status.geotrust.com",
    "status.rapidssl.com",
    "kr.ocsp.digicert.com",
    "ocsp.digicert-cn.com",
    "ocsp.edge.digicert.com",
    "ocsp.omniroot.com",
    "ocsp1.digicert.com",
    "ocsp2.digicert.com",
    "ocspx.digicert.com",
    "statusd.digitalcertvalidation.com",
    "statuse.digitalcertvalidation.com",
    "statusf.digitalcertvalidation.com",
    "statush.digitalcertvalidation.com",
    "www.public-trust.com"
)

# Function to resolve IP address
function Get-IP {
    param ([string]$hostname)
    try {
        $ip = (Resolve-DnsName -Name $hostname -ErrorAction Stop).IPAddress
        return $ip -join ", "  # Join multiple IPs if present
    }
    catch {
        return "Unknown"
    }
}

# Function to test connectivity
function Test-CRLServer {
    param ([string]$url)
    
    $hostname = ([System.Uri]::new("http://$url")).Host  # Ensure proper URL format
    $ipAddress = Get-IP -hostname $hostname

    Write-Host "`nTesting: $url (IP: $ipAddress)" -ForegroundColor Cyan

    try {
        $result = Test-NetConnection -ComputerName $hostname -Port 80 -WarningAction SilentlyContinue
        if ($result.TcpTestSucceeded) {
            Write-Host "[OK] Server reachable: $url (IP: $ipAddress)" -ForegroundColor Green
        } else {
            Write-Host "[FAIL] Cannot reach: $url (IP: $ipAddress)" -ForegroundColor Red
        }
    }
    catch {
        Write-Host "[FAIL] Error reaching: $url (IP: $ipAddress) - $_" -ForegroundColor Red
    }
}

# Run the test for each CRL URL
foreach ($crl in $crlUrls) {
    Test-CRLServer -url $crl
}

The output looks like this:

You can identify which CRL servers are unreachable.

Ensuring the operating system can access these servers is crucial for corporate security, as it allows verification that no certificates have been compromised. 

4. Resolving the Issue

Option A

If your corporate firewall and/or access control devices are configured to allow only a certain set of IP addresses to be accessed from your network, you need to include the DigiCert IP addresses to be able to access DigiCert via https.

DigiCert services have new dedicated IP addresses since 10.03.2026

Check DigiCert Documentation now 

Since Ivanti EPM 2024, you are able to disable the check per device.

Check Ivanti Documentation here.

5. Helpful Links

Updated IPs from DigiCert (March 2026)

[MS-OCSP]: Overview | Microsoft Doc