1. Identify the agents with mismatched certificates.
   1. On the OfficeScan server, open a command prompt and change the directory to <Server installation folder>\PCCSRV\Admin\Utility\CertificateManager.
       

      When using the Authentication Certificate Manager Tool, note the following requirements:

      • The user must have administrator privileges.
      • The tool can only manage certificates located on the local endpoint.

       
   2. Run command "CertificateManager.exe -l [Output CSV file full path]".

      For example:

      CertificateManager.exe -l D:\Test\MismatchedAgentList.csv

      All the agents with a mismatched certificate will be listed in a CSV file.

2. Recover the agent certificate by doing one of the following:
   • Option 1: Copy the IpXfer ([Server Path]\PCCSRV\Admin\Utility\IpXfer) and agent certificate ([Server Path]\PCCSRV\Pccnt\Common\OfcNTCer.dat) to the agent with a mismatched certificate.

     Execute the following command:

     • OfficeScan 11.0: IpXfer.exe/IpXfer_x64.exe -s <Target server name or IP> -p <server port> -c <agent port> -e OfcNTCer.dat –p <Unload Password>

       For example:

       IpXfer_x64.exe -s osce.contoso.local -p 8080 -c 12345 –e OfcNTCer.dat –p Password1

     • OfficeScan XG: IpXfer.exe/IpXfer_x64.exe -s <Target server name or IP> -p <server HTTP port> -sp <server HTTPS port> -c <agent port> -e OfcNTCer.dat -pwd <agent unload password>

       For example:

       IpXfer_x64.exe -s oscexg.contoso.local -p 8080 –sp 4343 -c 12345 –e OfcNTCer.dat -pwd P@ssw0rd

      

     Ipxfer parameters vary among versions. Go to the following article for more information: Manually transferring OfficeScan clients/agents using Client Mover I/Ipxfer tool.

      
   • Option 2: Reinstall the agent.
      

     Administrator can use single or multiple authentication keys across multiple OfficeScan servers in the same organization. View Authentication of Server-initiated Communications for more information.

      

If the issue persists, please contact Trend Micro Technical Support for assistance.

1. Contact your authorized Trend Micro Technical Support contact.
2. Provide your Customer Licensing Portal (CLP) Account and Apex One as a Service provision URL to Technical Support as well as issue details.
3. Obtain agent certificate from Technical Support.
4. Deploy the certificate to agents that reported this issue.

   Please refer to Manually transferring OfficeScan clients/agents using Client Mover I/Ipxfer tool for details.

As an alternative option, you can also reinstall the agent to fix this issue.