ZTNA – common problems

In this section, you will learn how to resolve common problems that you may encounter when you use Zero Trust Network Access.

Login troubleshooting

In this section, you will learn how to resolve login problems that you may encounter when you use Zero Trust Network Access (ZTNA). Follow the steps below. If one step does not solve your problem, try to escalate to the next step.

Important:
If you see a message Before signing in, the following issues must be resolved, ZTNA is working correctly, but your device does not meet the safety requirements to allow you to access the application. Follow the remediation steps described in the message and try again.
  1. Check if you are using a supported browser.
    We tested ZTNA using the following browsers:
    • Windows: Edge, Chrome, Firefox, Brave, Vivaldi, Opera
    • macOS: Safari, Chrome, Edge, Firefox, Brave, Vivaldi, Opera
    • iOS: Safari (other browsers are not supported due to the iOS architecture)
    • Android: Chrome, Edge, Brave, Vivaldi, Opera, Samsung Internet Browser (not supported: Firefox, Opera Mini)
  2. Fully restart your browser.

    If you have multiple browser windows open, close all the windows and wait at least 30 seconds for all background tasks to end.

    If this does not help:

  3. If you’re using the Microsoft Edge browser: Reset certificate choices.
    1. Click on the lock symbol to the left of the address bar.
    2. Select: Your certificate choices > Reset certificate choices > Reset choices.
    3. Restart Microsoft Edge.

    Microsoft Edge will ask you to select the certificate again.

    If this does not help:

  4. If you’re using macOS and Avast Antivirus, use another antivirus product.

    Avast on macOS manipulates the system certificates and makes it impossible to work with Conditional Access.

    If this does not help:

  5. If you’re using third-party firewall or VPN software, turn it off temporarily to see if it’s the cause of the problem.

    We found that the Nord VPN built-in security mechanism prevents browsers from sending certificates to web pages. This causes the following error: Client certificate validation failed. Other firewall/security products may have similar features.

    If this does not help:

  6. Restart your device.

    This lets you make sure that all browser processes are closed.

    If this does not help:

  7. If your company uses AgentP, check if you installed Portnox AgentP, logged in using your company credentials, and the application is running.

    If you feel that you may have not completed the installation and enrollment process correctly, uninstall AgentP and install it from scratch following the steps for your operating system (see the menu on the left side of this page).

    If this does not help:

  8. If your company does not use AgentP but uses Intune or Jamf, consult with your IT administrator to check if you have the required certificate on your device.
    • For Windows: In your Windows search bar, type: user cert, and then in the menu, click on Manage user certificates. In the certmgr window, go to Personal > Certificates and see if you have a certificate for your email address.
    • For other operating systems: Consult your IT staff for support.

    If this does not help:

  9. If all the above steps did not help, contact your local IT staff for support.

Common issue troubleshooting

In this section, you will find a list of common problems that you may encounter when configuring and using ZTNA, and you will learn how to resolve them.

Users see an Unknown error message when accessing a resource shortly after it was configured or changed to use a hostname

Unknown error. An unexpected error occurred, this may be due to an update to the resource, wait 2 minutes and try again. If this continues, contact your administrator. For more details, please contact the administrator and provide the following Tracking ID:

Reason: An administrator configured a new resource using a hostname, or edited an existing resource to change it from an IP address to a hostname. Resource hostname resolution is not performed instantly – it runs periodically, every 2 minutes. Until the next resolution cycle completes, a user attempting to access that resource may see the error above.

Solution:

  1. If you are a user who sees this error, wait at least 2 minutes (one resolution cycle) and try to access the resource again. In most cases, the resource will be reachable once the hostname has been resolved.
  2. If you are an administrator who just configured a resource with a hostname, or edited a resource to switch it from an IP address to a hostname, expect that users may see this error for up to 2 minutes afterward. This is normal and does not indicate a misconfiguration.
  3. If the error continues for more than 10 minutes (several resolution cycles), this is no longer expected behavior. The Tracking ID in the error message is not something an administrator can act on directly – at this point, contact Portnox Support and provide the Tracking ID so the issue can be investigated.