ERROR Exception in UrlAgent (url: /sitecore/service/keepalive.aspx) at System.Net.WebClient.DownloadDataInternal(Uri address, WebRequest& request)

Question

We have Sitecore 8.1, using 2 CD server on-premises and https protocol.

Log file getting below exception at

System.Net.WebClient.DownloadDataInternal(Uri address, WebRequest& request)

Error

ManagedPoolThread #10 00:11:10 ERROR Exception in UrlAgent (url: /sitecore/service/keepalive.aspx)
Exception: System.Net.WebException
Message: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel.
Source: System
   at System.Net.WebClient.DownloadDataInternal(Uri address, WebRequest& request)
   at System.Net.WebClient.DownloadData(Uri address)
   at Sitecore.Web.WebUtil.ExecuteWebPage(String url, NameValueCollection headers)
   at Sitecore.Tasks.UrlAgent.Run()

Nested Exception

Exception: System.Security.Authentication.AuthenticationException
Message: The remote certificate is invalid according to the validation procedure.
Source: System
   at System.Net.Security.SslState.StartSendAuthResetSignal(ProtocolToken message, AsyncProtocolRequest asyncRequest, Exception exception)
   at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.ForceAuthentication(Boolean receiveFirst, Byte[] buffer, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.ProcessAuthentication(LazyAsyncResult lazyResult)
   at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
   at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
   at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)
   at System.Net.TlsStream.ProcessAuthentication(LazyAsyncResult result)
   at System.Net.TlsStream.Write(Byte[] buffer, Int32 offset, Int32 size)
   at System.Net.PooledStream.Write(Byte[] buffer, Int32 offset, Int32 size)
   at System.Net.ConnectStream.WriteHeaders(Boolean async)

Please suggest.

Answer 1

You can try to set the valid host name in the keep alive config like:

<agent type="Sitecore.Tasks.UrlAgent" method="Run" interval="00:15:00">
  <param desc="url">https://<hostname>/sitecore/service/keepalive.aspx</param>
  <LogActivity>true</LogActivity>
</agent>

and in the hosts file on your server make sure that <hostname> is resolved to 127.0.0.1 IP address. Then your Load Balancer should not be hit - each of the servers should make a request to itself.

Alternatively, you can add http binding to your web apps with some other hostname (like cd1.local and cd2.local) and set that http url in UrlAgent like:

<agent type="Sitecore.Tasks.UrlAgent" method="Run" interval="00:15:00">
  <param desc="url">http://cd1.local/sitecore/service/keepalive.aspx</param>
  <LogActivity>true</LogActivity>
</agent>

Answer 2

Question looks very similar to this one, but a little bit different.

Before doing anything, you need to think whether you really need keepalive.aspx agent on your CD servers at all. You wrote that you have 2 CD servers. I guess that if you have few CD servers then you have load balancer.(I can't imagine how 2 Sitecore CD servers can work without it). All load balancers that I have worked with have healthy check requests. You can configure this health check to call keepalive.aspx. Example from AWS:

When you configure health check to ping keepalive.aspx on your load balancer, you can remove configuration of Sitecore.Tasks.UrlAgent to request /sitecore/service/keepalive.aspx from your servers configurations.

If for some reason you can't(or don't want) to do it on load balancer level then the proper way is to fix certificate on your IIS CD instance configuration.

If for some reasons you can't(or don't want) to fix certificate then you can configure HTTP binding as was suggested by Marek.

If you want to teach the keepalive.aspx agent to overcome TLS/SSL certificate warnings like in a referenced question then you can use my answer on that question.