# Test connection failing in web services connector

**URL:** <https://developer.sailpoint.com/discuss/t/test-connection-failing-in-web-services-connector/215317>\
**Category:** SHF Discussion and Questions\
**Tags:** webservice-connector, identity-security-cloud\
**Created:** [July 1, 2026, 6:12am UTC](https://developer.sailpoint.com/discuss/t/test-connection-failing-in-web-services-connector/215317 "2026-07-01T06:12:12Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![sandy\_sandy](https://avatars.discourse-cdn.com/v4/letter/s/43a26b/32.png) [@sandy\_sandy](https://developer.sailpoint.com/discuss/u/sandy_sandy)\
**Post date:** [July 1, 2026, 6:12am UTC](https://developer.sailpoint.com/discuss/t/test-connection-failing-in-web-services-connector/215317/1 "2026-07-01T06:12:12Z")

</div>

Hi,

I’m getting the below error when I try to test the connection in my web service va based connector.

 ![image](https://global.discourse-cdn.com/sailpoint/original/3X/f/a/fa55fe52f619912898923b9aad4b703c32d3a43b.png)

I tried passing the same token in the Web service saas connector. It’s working fine there

Could anybody help me with this, please?

---

<div class="post-metadata">

**Author:** ![sauvee](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/sauvee/32/23601_2.png) [@sauvee](https://developer.sailpoint.com/discuss/u/sauvee)\
**Post date:** [July 1, 2026, 6:18am UTC](https://developer.sailpoint.com/discuss/t/test-connection-failing-in-web-services-connector/215317/2 "2026-07-01T06:18:16Z")

</div>

There are several things to troubleshoot here, but considering the error message (connection reset), I suspect a firewall or proxy between the VA and the HTTP endpoint that is not cooperating on your end. Please try to use the **nc** command using the **tb** utility. See here: [https://community.sailpoint.com/t5/IdentityNow-Connectors/Virtual-Appliance-Troubleshooting-Guide/ta-p/78735#toc-hId-447447802](https://community.sailpoint.com/t5/IdentityNow-Connectors/Virtual-Appliance-Troubleshooting-Guide/ta-p/78735#toc-hId-447447802)

---

<div class="post-metadata">

**Author:** ![Gopi2000](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/gopi2000/32/21706_2.png) [@Gopi2000](https://developer.sailpoint.com/discuss/u/Gopi2000)\
**Post date:** [July 1, 2026, 6:20am UTC](https://developer.sailpoint.com/discuss/t/test-connection-failing-in-web-services-connector/215317/3 "2026-07-01T06:20:13Z")

</div>

Since the same token works with the Web Services SaaS connector, it doesn’t seem to be an authentication issue. The `Connection reset` error is usually related to network connectivity, firewall/proxy, or SSL trust between the Virtual Appliance and the target endpoint.

I’d recommend checking the **`ccg.log`** on the VA around the time of the failed test connection for any SSL handshake errors, proxy/network timeout messages, or additional exceptions that indicate why the remote host is resetting the connection. That should help narrow down the root cause.

---

<div class="post-metadata">

**Author:** ![Pankaj\_IAM\_SailPoint](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/pankaj_iam_sailpoint/32/38994_2.png) [@Pankaj\_IAM\_SailPoint](https://developer.sailpoint.com/discuss/u/Pankaj_IAM_SailPoint)\
**Post date:** [July 1, 2026, 6:43am UTC](https://developer.sailpoint.com/discuss/t/test-connection-failing-in-web-services-connector/215317/4 "2026-07-01T06:43:25Z")

</div>

@sandy_sandy I guess Firewall issues. Target application is blocking the Virtual Appliance (VA) or IdentityIQ server. you can check the port 443.

---

<div class="post-metadata">

**Author:** ![sandy\_sandy](https://avatars.discourse-cdn.com/v4/letter/s/43a26b/32.png) [@sandy\_sandy](https://developer.sailpoint.com/discuss/u/sandy_sandy)\
**Post date:** [July 1, 2026, 7:16am UTC](https://developer.sailpoint.com/discuss/t/test-connection-failing-in-web-services-connector/215317/5 "2026-07-01T07:16:12Z")

</div>

Thanks for the reply everyone,

Hi @sauvee ,

I tried using the **nc** command and the connection has been succeeded

---

<div class="post-metadata">

**Author:** ![punna0001](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/punna0001/32/42011_2.png) [@punna0001](https://developer.sailpoint.com/discuss/u/punna0001)\
**Post date:** [July 1, 2026, 8:53am UTC](https://developer.sailpoint.com/discuss/t/test-connection-failing-in-web-services-connector/215317/6 "2026-07-01T08:53:12Z")

</div>

Hello Sandy,

Since the `nc` test succeeded, basic connectivity from the VA to the endpoint looks okay. Is the Test Connection still failing in the connector, or has the issue been resolved now?

If it is resolved, please mark the correct reply as the solution so it helps others facing the same issue. If it is still failing, please share the latest error from `ccg.log` around the test connection time so we can continue checking.

Thanks.

---

<div class="post-metadata">

**Author:** ![sauvee](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/sauvee/32/23601_2.png) [@sauvee](https://developer.sailpoint.com/discuss/u/sauvee)\
**Post date:** [July 1, 2026, 9:11am UTC](https://developer.sailpoint.com/discuss/t/test-connection-failing-in-web-services-connector/215317/7 "2026-07-01T09:11:45Z")

</div>

@sandy_sandy , as mentioned here as well, please check the ccg.log when performing a test connection. You may even need to turn up the verbosity of your logging using these settings:

> **[Enable Connector Logging](https://documentation.sailpoint.com/connectors/duo/help/common/identitynow_topics/enable_connector_logging.html)**
>
> SailPoint Connectors Documentation

---

<div class="post-metadata">

**Author:** ![Bapu-Gogu](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/bapu-gogu/32/40049_2.png) [@Bapu-Gogu](https://developer.sailpoint.com/discuss/u/Bapu-Gogu)\
**Post date:** [July 1, 2026, 9:36am UTC](https://developer.sailpoint.com/discuss/t/test-connection-failing-in-web-services-connector/215317/8 "2026-07-01T09:36:50Z")

</div>

Hi @sandy_sandy

Connection reset + HTTP Error Code 0 = VA never completed the TLS handshake. The connection opened but got dropped before any HTTP response.

Quick checks in order:

1. Test reachability from the VA  
`curl -v --connect-timeout 10 https://:<host>:<port>`  
Fails? → Firewall rule missing. Fix that first.
2. Check CCG logs `tail -f /home/sailpoint/log/ccg.log | grep -i "socket|ssl|error", `this tells you exactly where the handshake broke.
3. Common culprits :  
3.1. TLS version mismatch between VA JVM and target  
3.2. VA IP not whitelisted on the target side  
3.3. Wrong URL scheme (http vs https)

Try above and post any logger here if you have, will be able to guide you better.

---

<div class="post-metadata">

**Author:** ![sandy\_sandy](https://avatars.discourse-cdn.com/v4/letter/s/43a26b/32.png) [@sandy\_sandy](https://developer.sailpoint.com/discuss/u/sandy_sandy)\
**Post date:** [July 1, 2026, 12:02pm UTC](https://developer.sailpoint.com/discuss/t/test-connection-failing-in-web-services-connector/215317/9 "2026-07-01T12:02:24Z")

</div>

@sauvee @punna0001 @Bapu-Gogu ,

Thanks for the replies,

I got this response for the below curl command I ran in my VA

curl -v [https://test.com/](https://test.com/)

Host [test.com:443](http://test.com:443) was resolved.

- IPv6: (none)
- IPv4: \*\*\*\*\*
- Trying \*\*\*\*
- ALPN: curl offers h2,http/1.1
- TLSv1.3 (OUT), TLS handshake, Client hello (1):
- CAfile: /etc/ssl/certs/ca-certificates.crt
- CApath: /etc/ssl/certs
- Recv failure: Connection reset by peer
- TLS connect error: error:00000000:lib(0)::reason(0)
- OpenSSL SSL\_connect: Connection reset by peer in connection to [test.com:443](http://test.com:443)
- closing connection #0 curl: (35) Recv failure: Connection reset by peer

---

<div class="post-metadata">

**Author:** ![sauvee](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/sauvee/32/23601_2.png) [@sauvee](https://developer.sailpoint.com/discuss/u/sauvee)\
**Post date:** [July 1, 2026, 12:09pm UTC](https://developer.sailpoint.com/discuss/t/test-connection-failing-in-web-services-connector/215317/10 "2026-07-01T12:09:42Z")

</div>

Can you do a curl -vvv to get very verbose information on the call?

I suspect it is indeed a tls issue and that the VA doesn’t have the proper certificate(s) in its certificate store.

---

<div class="post-metadata">

**Author:** ![sandy\_sandy](https://avatars.discourse-cdn.com/v4/letter/s/43a26b/32.png) [@sandy\_sandy](https://developer.sailpoint.com/discuss/u/sandy_sandy)\
**Post date:** [July 1, 2026, 12:18pm UTC](https://developer.sailpoint.com/discuss/t/test-connection-failing-in-web-services-connector/215317/11 "2026-07-01T12:18:56Z")

</div>

> [@sauvee](#):
>
> curl -vvv

Hi @sauvee ,

please find the information form the curl -vvv command

\*\*\*\*\* [0-x] == Info: [READ] client\_reset, clear readers  
\*\*\*\*\* [0-0] == Info: Host [test.com:443](http://test.com:443) was resolved.  
\*\*\*\*\* [0-0] == Info: IPv6: (none)  
\*\*\*\*\* [0-0] == Info: IPv4: \*\*\*\*\*  
\*\*\*\*\* [0-0] == Info: [HTTPS-CONNECT] adding wanted h2  
\*\*\*\*\* [0-0] == Info: [HTTPS-CONNECT] added  
\*\*\*\*\* [0-0] == Info: [HTTPS-CONNECT] connect, init  
\*\*\*\*\* [0-0] == Info: Trying \*\*\*\*\*:443…  
\*\*\*\*\* [0-0] == Info: [HTTPS-CONNECT] connect → 0, done=0  
\*\*\*\*\* [0-0] == Info: [HTTPS-CONNECT] Curl\_conn\_connect(block=0) → 0, done=0  
\*\*\*\*\* [0-0] == Info: [HTTPS-CONNECT] adjust\_pollset → 0, 1 socks  
\*\*\*\*\* [0-0] == Info: [SSL] cf\_connect()  
\*\*\*\*\* [0-0] == Info: [SSL] ossl\_connect, step1  
\*\*\*\*\* [0-0] == Info: ALPN: curl offers h2,http/1.1  
\*\*\*\*\* [0-0] == Info: [SSL] ossl\_connect, step2  
\*\*\*\*\* [0-0] =\> Send SSL data, 5 bytes (0x5)  
0000: …&  
\*\*\*\*\* [0-0] == Info: TLSv1.3 (OUT), TLS handshake, Client hello (1):  
\*\*\*\*\* [0-0] =\> Send SSL data, 1574 bytes (0x626)  
0000: …“…kOo…/.:…H…2”…\_\<2…F.. .1\>0(.f{.kO…Rn#.fG.4.  
0040: Z…K.^.\<…,.0…+./…$.(.k.#.'.g…9…3…=.  
0080: \<.5./…!..test.com…  
0580: ..npI@z…|N.m/..@.6.&B…;(.s:..&..lx@..4..s..B8S..b…9"  
05c0: .L…|.tq.[;-..?}y. ..z…A…]…5V…f…F$s..  
0600: .;… …l..\<..#./.4i.#…vxY^…|  
\*\*\*\*\* [0-0] == Info: [SSL] ossl\_bio\_cf\_out\_write(len=1579) → 0, 1579  
\*\*\*\*\* [0-0] == Info: [SSL] ossl\_bio\_cf\_in\_read(len=5) → 81, 0  
\*\*\*\*\* [0-0] == Info: [SSL] ossl\_populate\_x509\_store, path=/etc/ssl/certs/ca-certificates.crt, blob=0  
\*\*\*\*\* [0-0] == Info: CAfile: /etc/ssl/certs/ca-certificates.crt  
\*\*\*\*\* [0-0] == Info: CApath: /etc/ssl/certs  
\*\*\*\*\* [0-0] == Info: [SSL] SSL\_connect() → err=-1, detail=2  
\*\*\*\*\* [0-0] == Info: [SSL] SSL\_connect() → want recv  
\*\*\*\*\* [0-0] == Info: [SSL] cf\_connect() → 0, done=0  
\*\*\*\*\* [0-0] == Info: [HTTPS-CONNECT] connect → 0, done=0  
\*\*\*\*\* [0-0] == Info: [HTTPS-CONNECT] Curl\_conn\_connect(block=0) → 0, done=0  
\*\*\*\*\* [0-0] == Info: [SSL] adjust\_pollset, POLLIN fd=4  
\*\*\*\*\* [0-0] == Info: [HTTPS-CONNECT] adjust\_pollset → 0, 1 socks  
\*\*\*\*\* [0-0] == Info: [SSL] cf\_connect()  
\*\*\*\*\* [0-0] == Info: [SSL] ossl\_connect, step2  
\*\*\*\*\* [0-0] == Info: Recv failure: Connection reset by peer  
\*\*\*\*\* [0-0] == Info: [SSL] ossl\_bio\_cf\_in\_read(len=5) → 56, 0  
\*\*\*\*\* [0-0] == Info: [SSL] SSL\_connect() → err=-1, detail=5  
\*\*\*\*\* [0-0] == Info: TLS connect error: error:00000000:lib(0)::reason(0)  
\*\*\*\*\* [0-0] == Info: OpenSSL SSL\_connect: Connection reset by peer in connection to [test.com:443](http://test.com:443)  
\*\*\*\*\* [0-0] == Info: [SSL] cf\_connect() → 35, done=0  
\*\*\*\*\* [0-0] == Info: [HTTPS-CONNECT] connect, all attempts failed  
\*\*\*\*\* [0-0] == Info: [HTTPS-CONNECT] connect → 35, done=0  
\*\*\*\*\* [0-0] == Info: [HTTPS-CONNECT] Curl\_conn\_connect(block=0) → 35, done=0  
\*\*\*\*\* [0-0] == Info: [HTTPS-CONNECT] Curl\_conn\_connect(), filter returned 35  
\*\*\*\*\* [0-0] == Info: [WRITE] [OUT] done  
\*\*\*\*\* [0-0] == Info: closing connection #0  
curl: (35) Recv failure: Connection reset by peer

---

<div class="post-metadata">

**Author:** ![sauvee](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/sauvee/32/23601_2.png) [@sauvee](https://developer.sailpoint.com/discuss/u/sauvee)\
**Post date:** [July 2, 2026, 6:45am UTC](https://developer.sailpoint.com/discuss/t/test-connection-failing-in-web-services-connector/215317/12 "2026-07-02T06:45:48Z")

</div>

I would check which certificate is being used by the API you are calling and then import that certificate into the VA certificate store.

Use openssl command to get the certificate:  
`openssl s_client -connect server.domain.local:port`

Copy the output into a new file and place it under:  
`/home/sailpoint/certificates`

Then restart CCG  
`sudo systemctl restart ccg`

---

<div class="post-metadata">

**Author:** ![sandy\_sandy](https://avatars.discourse-cdn.com/v4/letter/s/43a26b/32.png) [@sandy\_sandy](https://developer.sailpoint.com/discuss/u/sandy_sandy)\
**Post date:** [July 2, 2026, 8:45am UTC](https://developer.sailpoint.com/discuss/t/test-connection-failing-in-web-services-connector/215317/13 "2026-07-02T08:45:55Z")

</div>

Just a question, Is it mandatory to pass the certificate? To generate the token I’m using a private key, since it’s a JWT based authentication

I’ll try adding the certificate into the va and test it once again

Thanks

---

<div class="post-metadata">

**Author:** ![baoussounda](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/baoussounda/32/13095_2.png) [@baoussounda](https://developer.sailpoint.com/discuss/u/baoussounda)\
**Post date:** [July 2, 2026, 10:06am UTC](https://developer.sailpoint.com/discuss/t/test-connection-failing-in-web-services-connector/215317/14 "2026-07-02T10:06:59Z")

</div>

@sandy_sandy ,

When communicating with your application, SailPoint must trust your public key certificate before making any API calls using HTTPS protocol.

This PKI certificate must be added to your Virtual Appliance by following the steps described by @sauvee

This certificate is different from the private key used for JWT authentication.

---

<div class="post-metadata">

**Author:** ![smandal](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/smandal/32/39033_2.png) [@smandal](https://developer.sailpoint.com/discuss/u/smandal)\
**Post date:** [July 2, 2026, 12:41pm UTC](https://developer.sailpoint.com/discuss/t/test-connection-failing-in-web-services-connector/215317/15 "2026-07-02T12:41:04Z")

</div>

Try out curl from the VA itself and if possible share here, can try figure out the issue if nothing sensitive info is there in your dev. Most probably a cert issue.

---

<div class="post-metadata">

**Author:** ![punna0001](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/punna0001/32/42011_2.png) [@punna0001](https://developer.sailpoint.com/discuss/u/punna0001)\
**Post date:** [July 2, 2026, 12:52pm UTC](https://developer.sailpoint.com/discuss/t/test-connection-failing-in-web-services-connector/215317/16 "2026-07-02T12:52:20Z")

</div>

Hello Sandy,

No, the JWT private key and the HTTPS certificate are two different things.

The private key is used later for JWT authentication. But your curl output shows the connection is failing before it even reaches the authentication/token stage. The VA sends the TLS ClientHello and then the target resets the connection, so this looks more like TLS/network/WAF behavior from the target side, not a JWT issue.

Also, since the Web Services SaaS connector works, that only proves the token/API works from SailPoint cloud path. The VA-based connector is coming from your VA network path, so the target may still be blocking or rejecting the VA traffic.

Here is how I would work through it:

First, confirm the API/WAF/load balancer allows the VA outbound/public IP. Then run this from the VA:

```auto
openssl s_client -connect <host>:443 -servername <host> -showcerts

```

If it returns the certificate chain, copy the required root/intermediate PEM certs to `/home/sailpoint/certificates/` on every VA in the cluster. Then restart CCG:

```auto
sudo systemctl restart ccg

```

After restart, check `/home/sailpoint/log/ccg-start.log` and `ccg.log` to confirm the cert import. If `openssl` also gets reset before showing the certificate, then importing the cert alone would not fix it. In that case the target side needs to check TLS policy, SNI/hostname, cipher/TLS version support, WAF rules, and VA IP allowlisting.

So short answer: certificate is not part of the JWT token generation, but the VA still must trust the API server certificate and the target must allow the VA TLS connection before JWT auth can even happen.

---

<div class="post-metadata">

**Author:** ![sandy\_sandy](https://avatars.discourse-cdn.com/v4/letter/s/43a26b/32.png) [@sandy\_sandy](https://developer.sailpoint.com/discuss/u/sandy_sandy)\
**Post date:** [July 3, 2026, 6:53am UTC](https://developer.sailpoint.com/discuss/t/test-connection-failing-in-web-services-connector/215317/17 "2026-07-03T06:53:50Z")

</div>

Hi @sauvee ,

I uploaded the certificate into the certificates folder and tried the test connection again, but it’s still showing the same error

 ![image](https://global.discourse-cdn.com/sailpoint/original/3X/c/1/c14c7508f14b111579e9164e20ea524bcb583b2e.png)

---

<div class="post-metadata">

**Author:** ![sauvee](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/sauvee/32/23601_2.png) [@sauvee](https://developer.sailpoint.com/discuss/u/sauvee)\
**Post date:** [July 6, 2026, 6:43am UTC](https://developer.sailpoint.com/discuss/t/test-connection-failing-in-web-services-connector/215317/18 "2026-07-06T06:43:22Z")

</div>

Did you make sure to reboot the ccg:  
`sudo systemctl restart ccg`

---

<div class="post-metadata">

**Author:** ![sandy\_sandy](https://avatars.discourse-cdn.com/v4/letter/s/43a26b/32.png) [@sandy\_sandy](https://developer.sailpoint.com/discuss/u/sandy_sandy)\
**Post date:** [July 6, 2026, 9:55am UTC](https://developer.sailpoint.com/discuss/t/test-connection-failing-in-web-services-connector/215317/19 "2026-07-06T09:55:01Z")

</div>

Yes I did restart the ccg

---

<div class="post-metadata">

**Author:** ![baoussounda](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/baoussounda/32/13095_2.png) [@baoussounda](https://developer.sailpoint.com/discuss/u/baoussounda)\
**Post date:** [July 6, 2026, 11:11am UTC](https://developer.sailpoint.com/discuss/t/test-connection-failing-in-web-services-connector/215317/21 "2026-07-06T11:11:02Z")

</div>

@sandy_sandy with this command :

```auto
openssl s_client -connect host_name:443 -showcerts

```

Are you able to see the server certificate from the VA ?

[Next page](https://developer.sailpoint.com/discuss/t/test-connection-failing-in-web-services-connector/215317.md?page=2)