Facing issues with Queue build(s) failed.

[spatel-crestron]

Over last few days we have been facing below error message soon as Queue build task initiates. Would someone be available to help identify which certificate in particular is expired? I have reviewed all apsects of the CERTs from DEVOPS Server, Agent Server, and have not been able to identify which cert is expired.

Error: certificate has expired
at Error (native)
at TLSSocket. (_tls_wrap.js:1092:38
at emitNone (events.js:86:13)
at TLSSocket.emit (events.js:185:7)
at TLSSocket._finishInit (_tls_wrap.js:610:8)
at TLSWrap.ssl.onhandshakedone (_tls_wrap.js:440:38) code: 'CERT_HAS_EXPIRED' }

[bamminger]

Are you using an on premise installation of DevOps or the SaaS version?
Is there more information in the error message available or a longer stack trace maybe?

[spatel-crestron]

Yes, we have on prem Enterprise installation. Above is all I get in the debug enabled logs.

[bamminger]

I assume you are using a self signed certificate?

Which certificate is used when you navigate in a browser (where you are signed in) to one of the api urls?
e.g.: https://..../_apis/projects
for TFS the url is {server:port}/tfs/{collection} according to https://learn.microsoft.com/en-us/rest/api/azure/devops/?view=azure-devops-rest-7.2

Is that certificate valid and installed on your build servers?

[spatel-crestron]

We have Entrust Certification Authority cert that is signed and valid. I am able to browse the APIs/projects path and get valid details about projects. We have also updated our Agent servers to have the same certificate. yet we continue to get the message that CERT has expired. Is there any other URLs specifically we can try to manually walk thru for the Task?

[bamminger]

What versions are you running on? node.js, DevOps Server?
Everything I found regarding the same error seems to be due to some old node.js (bower/registry#304) or actually outdated certificate chain (https://developercommunity.visualstudio.com/t/ca-certificate-expired-causing-our-connection-to-b/1060589#T-N1064824)

One thing that's still strange to me, is the fact that the error log contains no file of the extension. So if the code fails during an api call, I would expect any code file of the extension in the stack trace.

[spatel-crestron]

Thanks for your support. We were able to identify a Cert that was getting cached somehow with the TFS2018 Application. Once we restarted the services the issue was resolved.

[spatel-crestron]

We are all good now.