# How to onboard AD Application in ISC - local lab setup running entirely on VMware Workstation on a single Windows host machine: **URL:** \ **Category:** SHF Discussion and Questions\ **Tags:** identity-security-cloud\ **Created:** [April 27, 2026, 3:24am UTC](https://developer.sailpoint.com/discuss/t/how-to-onboard-ad-application-in-isc-local-lab-setup-running-entirely-on-vmware-workstation-on-a-single-windows-host-machine/205554 "2026-04-27T03:24:59Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![sathish3004](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/sathish3004/32/34309_2.png) [@sathish3004](https://developer.sailpoint.com/discuss/u/sathish3004)\ **Post date:** [April 27, 2026, 3:25am UTC](https://developer.sailpoint.com/discuss/t/how-to-onboard-ad-application-in-isc-local-lab-setup-running-entirely-on-vmware-workstation-on-a-single-windows-host-machine/205554/1 "2026-04-27T03:25:00Z")
**Title:** IQService Test Connection fails with “No matching certificate found” even after self-signed cert is created with correct subject (Local VMware lab setup) * * * **Environment / Setup:** This is a **local lab setup** running entirely on **VMware Workstation** on a single Windows host machine: - **VA (Virtual Appliance):** deployed locally on VMware Workstation, paired with my ISC tenant and showing **Connected** in the cluster - **AD + IQService server:** Windows Server 2016 VM running on the **same VMware Workstation host** (not in cloud, not in a corporate network) - Both VMs are on the **same VMware NAT network** (`192.168.75.x`) - VA IP: `192.168.75.143` - AD VM IP: `192.168.75.147` (static) - AD domain: `boa.com`, hostname: `WIN-TH0V3NI5FQ4` - Domain controller, IQService, and Windows Firewall all configured on the same VM - **IQService:** installed in TLS mode using `IQService.exe -i -o 5050` * * * **Issue:** When testing the AD source connection from the ISC UI, I get: ```auto Timeout waiting for response to message 7 from client f13a3f04-... after 15 seconds ``` IQTrace.log on the IQService server shows: ```auto RpcHandler [Thread-6] ERROR : "An Exception occurred while accepting new client request System.Exception: No matching certificate found for WIN-TH0V3NI5FQ4.boa.com at sailpoint.rpcserver.RpcHandler..ctor(Hashtable services, Hashtable registry, TcpClient client, String port, Boolean useTLS, String subject, String tlsVersion, String registeredClients, String serialNumber)" ``` * * * **What I have verified:** 1. **Network connectivity from VA → IQService server is fine** (both VMs on same VMware NAT subnet): 2. **Windows Firewall rule** for inbound TCP 5050 is in place on the AD VM. 3. **IQService is running and listening:** 4. **Self-signed cert created with the exact subject IQService is asking for:** 5. **IQService was restarted after cert creation** (confirmed via Application event log timestamp). 6. **NETWORK SERVICE permission** granted on the private key folder via `icacls`. 7. **In ISC source config (IQService Settings):** * * * Despite all of the above, the same “No matching certificate found” error continues to appear in `IQTrace.log` on every Test Connection attempt. * * * **Questions:** 1. **Where exactly does IQService look for the cert?** Does it search only `LocalMachine\My`, or does it also require the cert in `Trusted Root Certification Authorities`? 2. **Are there additional cert requirements** beyond Subject CN match? For example: 3. **Is there a SailPoint-provided script** bundled with IQService for generating TLS certs in the exact expected format? I checked the install folder and didn’t find one. 4. **Does the cert subject need to match** the machine FQDN exactly, the NetBIOS name, or some other format specific to the IQService instance? 5. **For a lab/local-VMware test setup** , is there a supported way to disable TLS enforcement on IQService and run on plain TCP/5050? (For real client work I’d of course use proper TLS — just want to validate end-to-end flow first.) * * * Any pointers on what specifically IQService matches against during cert lookup would be very helpful. I’ve reviewed the official TLS configuration documentation but want to confirm the exact cert spec for this IQService version. Thanks in advance! ---
**Author:** ![narayanag](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/narayanag/32/25441_2.png) [@narayanag](https://developer.sailpoint.com/discuss/u/narayanag)\ **Post date:** [April 27, 2026, 4:07am UTC](https://developer.sailpoint.com/discuss/t/how-to-onboard-ad-application-in-isc-local-lab-setup-running-entirely-on-vmware-workstation-on-a-single-windows-host-machine/205554/2 "2026-04-27T04:07:42Z")
As it is lab. Can you disable TLS? and see the flow. ---
**Author:** ![punna0001](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/punna0001/32/42011_2.png) [@punna0001](https://developer.sailpoint.com/discuss/u/punna0001)\ **Post date:** [April 27, 2026, 4:10am UTC](https://developer.sailpoint.com/discuss/t/how-to-onboard-ad-application-in-isc-local-lab-setup-running-entirely-on-vmware-workstation-on-a-single-windows-host-machine/205554/3 "2026-04-27T04:10:02Z")
Hello Sathish, Based on my research & looking at your logs, this isn’t a connectivity issue. VA is reaching 5050. The failure is happening during IQService certificate lookup. ```auto No matching certificate found for WIN-TH0V3NI5FQ4.boa.com ``` A few things to fix: 1. Don’t use IP for IQService Host when TLS is enabled. Use the FQDN: ```auto WIN-TH0V3NI5FQ4.boa.com ``` The cert CN/SAN must match this, and the VA must be able to resolve it. 1. Check the certificate — most likely gap here is EKU: 2. Make sure VA trusts the cert: ```auto /home/sailpoint/certificates ``` - Restart CCG I would start with FQDN + EKU. This error usually comes down to one of those. Try these & plz let me know if that resolves your issue. ---
**Author:** ![rabappy](https://avatars.discourse-cdn.com/v4/letter/r/9d8465/32.png) [@rabappy](https://developer.sailpoint.com/discuss/u/rabappy)\ **Post date:** [April 27, 2026, 4:19am UTC](https://developer.sailpoint.com/discuss/t/how-to-onboard-ad-application-in-isc-local-lab-setup-running-entirely-on-vmware-workstation-on-a-single-windows-host-machine/205554/4 "2026-04-27T04:19:14Z")
In SailPoint Identity Security Cloud: **• Where does IQService look for the cert?** It looks in **LocalMachine\My (Personal)** store. Trusted Root is not required for selection, but adding it there can help with trust in some setups. **• Additional cert requirements?** Yes — important ones: - Must include **Server Authentication EKU (1.3.6.1.5.5.7.3.1)** - Must have a **private key** - SAN is recommended (FQDN/hostname), but not strictly enforced in all cases **• CA-signed vs self-signed?** Self-signed works fine for lab/testing. CA-signed is recommended for production. **• Any SailPoint script for cert creation?** No, there’s no built-in script — standard Windows cert tools are typically used. **• Subject name requirement?** Should match the **machine FQDN** (preferred). NetBIOS may work in some cases, but FQDN is the safest. **• Can TLS be disabled for lab?** Yes — you can install/run IQService **without TLS (plain TCP/5050)** for testing purposes. ---
**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\ **Post date:** [June 26, 2026, 4:19am UTC](https://developer.sailpoint.com/discuss/t/how-to-onboard-ad-application-in-isc-local-lab-setup-running-entirely-on-vmware-workstation-on-a-single-windows-host-machine/205554/5 "2026-06-26T04:19:48Z")
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.