Illumio Community Hub

we got only warning that web service certificate is lacking extendedkey usage client capability,

kindly need your help,

thanks a lot

Please review our installation guide in detail:

https://product-docs-repo.illumio.com/Tech-Docs/Core/25.2/Install-Upgrade-Admin/out/en/pce-installation-and-upgrade-guide/prepare-for-pce-installation/requirements-for-pce-installation.html

Common omissions include DNS and certificate requirements. Ensure you have the full chain if it is signed by a Certificate Authority (CA). Additionally, verify that it is included in the local OS certificate store.

In the installation and configuration documentation, please review and validate the setup list and the corresponding test commands:

https://product-docs-repo.illumio.com/Tech-Docs/Core/25.2/Install-Upgrade-Admin/out/en/pce-installation-and-upgrade-guide/pce-installation/configure-the-pce.html

There are also several valuable knowledge base articles on our support portal regarding certificates, such as:

https://support.illumio.com/knowledge-base/articles/Preparing-Certificates-for-an-Illumio-MNC-Installation.html

https://support.illumio.com/knowledge-base/articles/Understanding-Illumio-Trial-Certificates.html

If you continue to experience issues or have any troubles, please reach out to your Illumio account team or Illumio partner representative.

In this particular case, it appears from the screenshot that you are missing extended key usage Client Authentication on the server certificate you are using. This was a requirement in all but our latest PCE version. However, this EKU is now being sunset by Certificate Authorities and must be explicitly requested if required.

Your options are to either upgrade the PCE to the latest available version that no longer requires Client Auth EKU on certificates, or to get a new version of your certificate that includes the client Auth EKU option.

Dear Jason and Harit,

thanks a lot for your insight,

we would like to discuss it with my colleagues ,

Dear @Harit Premkumar ,

could you please suggest which version most suitable ? currently we are use version 25.2.20

@Hudaya Hudaya For the 25.X stream, 25.2.31 is what you need if you want to use a certificate without Client Authentication EKU. https://product-docs-repo.illumio.com/Tech-Docs/Core/25.2/Release-Notes/out/en/what-s-new-in-25-2/what-s-new-in-25-2-30/what-s-new-in-25-2-30.html

Dear @Harit Premkumar ,

thanks for your information,

we still needed approval to get to the portal download software menu at illumio portal,

and then after that we could check it,

thankyou

Dear @Harit Premkumar ,

is version for RHEL10 compatible with redhat 9 rpm package illumio ? we couldnt find redhat 10 rpm, but we already install RHEL 10 on our server,

Yes, the el9 or RHEL 9 binaries are compatible and the supported binaries for RHEL 10 and RHEL 10 compatible distributions.

dear @Jason Fletcher  and @Harit Premkumar ,

noted , thanks , we currently could install this package with rhel 10, and succeed install certificate existing,

but while pairing with workload still got error, could you please inform us whats wrong with this error ? attached the screenshot,

thanks a lot Jason and Harit,

There is a known issue with the api version in the URL. Please update the api version v28 to a lower version, for example, v25 in the URL. This will be fixed in the next release. Thanks and let us know if you have any other questions or concerns.

Also, I assume that URL is internal and this is a test build, but please be careful how your share and store keys.

Dear @Jason Fletcher ,

could you please provide to us for api version v25 ?

No, I apologize if that was unclear. Please just update the number in the URL for the pairing script download request.

Sorry Jason,

i just need to change the script from v28 to v25 ?

Yes. Just change the v28 to v25. Here are a few more details: our VEN versions are typically supported for 3+ years. For example, our major VEN 25 versions will be supported up to the PCE major version 28. There was an oversight regarding the compatibility between this PCE and VEN version, which is hard-coded on the backend.

@Hudaya Hudaya I think you're going to need to use an older VEN version - 25.2.31 perhaps. In your pairing profile, set the VEN version to an older one.

This is probably due to a lack of compatibility of VEN 25.5 with PCE 25.5. See the warning on the support page.

Dear @Harit Premkumar ,

we are using ven version 25.2.20 but still error like this,

even though we check it should be compatible with 25.2.20

and we couldnt find 25.2.30 version,

kindly need your help again

thankyou

Dear @Harit Premkumar and @Jason Fletcher ,

currently we succeed inject private customer ssl and pairing,

thanks a lot for your support,

Dear @Harit Premkumar and @Jason Fletcher ,

sorry to ping you,

today we tried to implement to customer server, but we couldn't inject illumio script,

we try to upload the ven manually , and install + activate with illumio key, and succeed,

but status active workload just stuck on active sync,

could you please check our log ?

[root@appilmondc2 itspam_ssh]# /opt/illumio_ven/illumio-ven-ctl status connectivity

{"last_successful_hb": "2026-03-06T17:40:15+07:00", "time_now": "2026-03-06T17:41:11+07:00", "connectivity": {"pce": "pce.bankbjb.co.id", "port": 8443, "ips_returned": 1, "results": [{"ip": "172.17.24.201", "http_code": 0, "result": "fail", "reason": "SSL connect error"}]}}

[root@appilmondc2 itspam_ssh]# /opt/illumio_ven/illumio-ven-ctl status connectivity

{"last_successful_hb": "2026-03-06T17:40:15+07:00", "time_now": "2026-03-06T17:41:13+07:00", "connectivity": {"pce": "pce.bankbjb.co.id", "port": 8443, "ips_returned": 1, "results": [{"ip": "172.17.24.201", "http_code": 204, "result": "pass"}]}}

we are check telnet port 8443 to pce is connected, traceroute connected, ping connected,

kindly please your help,

thanks

It seems there is a certificate issue. Please ensure that clients have the full certificate chain of the PCE, or that they trust the Certificate Authority.

Dear @Jason Fletcher ,

we are using exactly same certificate as our lab , sir,

we are check the port 8443 end to end already open, traceroute going through, ping normal, no block from firewall,

could you please inform us how to troubleshoot it ? we check from log just said connection reset or ssl error,

kindly please need your advise,

thanks

is it communication between PCE and endpoint server just through port 8443 right sir ? or is something else ?

kindly need your advise,

thanks

Please check that the PCE's root and intermediate certificates are installed on the endpoint / server workload OS's certificate bundle. For example if this is RHEL 8 and higher - place the root and intermediate certs on the endpoint / server and add it to the certificate store:

# cp pce.intermediate.ca.crt /etc/pki/ca-trust/source/anchors/

# cp pce.root.ca.crt /etc/pki/ca-trust/source/anchors/

# update-ca-trust extract

# openssl verify ./pce.intermediate.ca.crt

./pce.intermediate.ca.crt: OK

# openssl verify ./pce.root.ca.crt

/pce.root.ca.crt: OK

If this does not work, please reach out to our support team.

Dear @Harit Premkumar ,

all of command u provide is already we input and certificate is OK,

is it communication between PCE and endpoint host server just through with port 8443 or another port must be open sir ?

thanks

Dear Harit and Jason,

sorry for the trouble,

we already solved the issue,

its because blocked from our NAC, that before didnt block our traffic, but suddenly yesterday block it,

thanks a lot for your response