ERROR Cannot start analytics Tracker

Question

I get below error in Content Delivery Environment in Sitecore 9.0.2

11284 11:00:12 ERROR Cannot start analytics Tracker Exception:
System.Net.Http.HttpRequestException Message: An error occurred while
sending the request. Source: Sitecore.Xdb.Common.Web
    at Sitecore.Xdb.Common.Web.Synchronous.SynchronousExtensions.SuspendContextLock[TResult](Func\`1 taskFactory)
    at Sitecore.Analytics.DataAccess.Dictionaries.DataStorage.ReferenceDataClientDictionary.EnsureDefinitionType(String definitionTypeName)
    at Sitecore.Analytics.DataAccess.Dictionaries.DataStorage.ReferenceDataClientDictionary.LoadAs[T](Object key)
    at Sitecore.Analytics.DataAccess.Dictionaries.AverageCounterExtensions.MeasureMilliseconds[T](AverageCounter counter, Func\`1 func)
    at Sitecore.Analytics.DataAccess.Dictionaries.ReferenceDataDictionary\`2.Get(TKey key, LookupStrategy strategy)
    at Sitecore.Analytics.DataAccess.Dictionaries.UserAgentsDictionary.Register(String userAgentName)
    at Sitecore.Analytics.Tracking.CurrentVisitContext.set_UserAgent(String value)
    at Sitecore.Analytics.Pipelines.CreateVisits.InitializeWithRequestData.Process(CreateVisitArgs args)
    at (Object , Object )
    at Sitecore.Pipelines.CorePipeline.Run(PipelineArgs args)
    at Sitecore.Pipelines.DefaultCorePipelineManager.Run(String pipelineName, PipelineArgs args, String pipelineDomain, Boolean failIfNotExists)
    at Sitecore.Pipelines.DefaultCorePipelineManager.Run(String pipelineName, PipelineArgs args, String pipelineDomain)
    at Sitecore.Analytics.Pipelines.CreateVisits.CreateVisitPipeline.Run(CreateVisitArgs args)
    at Sitecore.Analytics.Tracking.StandardSession.CreateInteraction(HttpContextBase httpContext)
    at Sitecore.Analytics.Pipelines.InitializeTracker.CreateVisit.Process(InitializeTrackerArgs args)
    at (Object , Object )
    at Sitecore.Pipelines.CorePipeline.Run(PipelineArgs args)
    at Sitecore.Pipelines.DefaultCorePipelineManager.Run(String pipelineName, PipelineArgs args, String pipelineDomain, Boolean failIfNotExists)
    at Sitecore.Pipelines.DefaultCorePipelineManager.Run(String pipelineName, PipelineArgs args, String pipelineDomain)
    at Sitecore.Analytics.Pipelines.InitializeTracker.InitializeTrackerPipeline.Run(InitializeTrackerArgs args)
    at (Object , Object )
    at Sitecore.Pipelines.CorePipeline.Run(PipelineArgs args)
    at Sitecore.Pipelines.DefaultCorePipelineManager.Run(String pipelineName, PipelineArgs args, String pipelineDomain, Boolean failIfNotExists)
    at Sitecore.Pipelines.DefaultCorePipelineManager.Run(String pipelineName, PipelineArgs args, String pipelineDomain)
    at Sitecore.Analytics.Pipelines.StartTracking.StartTrackingPipeline.Run(StartTrackingArgs args)
    at Sitecore.Analytics.DefaultTracker.StartTracking()
Nested Exception
Exception: System.Net.WebException Message: The request was aborted:
Could not create SSL/TLS secure channel. Source: System
    at System.Net.HttpWebRequest.EndGetResponse(IAsyncResult asyncResult)
    at System.Net.Http.HttpClientHandler.GetResponseCallback(IAsyncResult ar)

Answer 1

My application was running under AppPoolIdentity. Below steps fixed the issue.

1. Change my App pool to run with Network Service
2. Go to mmc, Go to personal store. Right click on Xconnect client certificate. Manage private keys, then I added "Network Service" to access private keys.

Answer 2

Your application pool may not have access to the SSL certificate(s) that your site host names are bound to (or the certificates that are referenced in your ConnectionStrings.config).

You can use this PowerShell script to resolve the issue:

param (
    [Parameter(Mandatory=$true)]
    [string]$Thumbprint,

    [Parameter(Mandatory=$true)]
    [string]$AppPool
)

function Grant-AppPoolAccessToCert {
    param (
        [string]$Thumbprint,
        [string]$AppPool
    )

    $AppPoolName = "IIS AppPool\$AppPool"

    try {
        # Load required .NET assemblies
        Add-Type -AssemblyName System.Security

        # Open certificate store and find the cert
        $Store = New-Object System.Security.Cryptography.X509Certificates.X509Store("My", "LocalMachine")
        $Store.Open([System.Security.Cryptography.X509Certificates.OpenFlags]::ReadWrite)
        $Cert = $Store.Certificates | Where-Object { $_.Thumbprint -eq $Thumbprint }

        if ($Cert -ne $null) {
            # Get the certificate's private key file path
            $KeyPath = $Cert.PrivateKey.CspKeyContainerInfo.UniqueKeyContainerName
            $KeyFullPath = "C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\$KeyPath"

            if (Test-Path $KeyFullPath) {
                # Get current ACL of the private key
                $Acl = Get-Acl $KeyFullPath

                # Check if app pool already has access
                if ($Acl.Access | Where-Object { $_.IdentityReference -eq $AppPoolName }) {
                    Write-Host "$AppPoolName already has access to certificate $Thumbprint"
                } else {
                    # Add new access rule for the app pool
                    $AccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule($AppPoolName, "Read", "Allow")
                    $Acl.SetAccessRule($AccessRule)

                    # Apply new ACL to the private key file
                    Set-Acl -Path $KeyFullPath -AclObject $Acl
                    Write-Host "Access granted to $AppPoolName for certificate $Thumbprint"
                }
            } else {
                Write-Host "Key file for certificate $Thumbprint not found"
            }
        } else {
            Write-Host "Certificate with thumbprint $Thumbprint not found"
        }
    } catch {
        Write-Host "An error occurred: $_"
    } finally {
        $Store.Close()
    }
}

Grant-AppPoolAccessToCert -Thumbprint $Thumbprint -AppPool $AppPool

$RestartAppPool = Read-Host "Do you want to restart the app pool? (Y/N)"
if ($RestartAppPool -eq "Y") {
    Restart-WebAppPool $AppPool
    Write-Host "App pool $AppPool restarted"
}

Run the script like so:

.\Grant-AppPoolAccessToCert.ps1 -Thumbprint "YOUR_CERT_THUMBPRINT" -AppPool "YOUR_APP_POOL_NAME"

You will want to run this for each each of your Sitecore app pools.