> For the complete documentation index, see [llms.txt](https://help.security.gallagher.com/knowledge-hub/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.security.gallagher.com/knowledge-hub/products/cc-hardware/credentials/mobile-connect/troubleshoot/mobile-connect-02-cloud-service-not-ac.md). # Cloud service is not accepting registrations Diagnose cloud connectivity, certificate, firewall, and proxy issues that block Mobile Connect registrations. ### Diagnose the issue 1. Create a credential and save it. 2. Open the Command Centre server's Cloud Properties and check the **Status and Overrides** tab. * If the status shows **"sending"**, the Cloud service is **offline**. Proceed with the steps below. * If the status shows **"awaiting registration"**, the Cloud service is **online**. Deleting the cloud is pointless here. Go to [05. Credentials not Sending to a Client](/knowledge-hub/products/cc-hardware/credentials/mobile-connect/troubleshoot/mobile-connect-05-credentials-not-send.md). ![Cloud service offline screenshot](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-d53b8acbbf5942c84e0f4b79dd14b8def4fe75b2%2FSECHUB-MOBILE-02-01-cloud-service-offline-screenshot.png?alt=media) ![Cloud connectivity test result](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-3163f8a7596fdec19e9312bbb02ade5bbe98b51a%2FSECHUB-MOBILE-02-02-cloud-connectivity-test.png?alt=media) ### Firewall requirements Outbound TCP 443 must be allowed from the Command Centre server to: * Gallagher Cloud Server: `52.62.211.7` and `54.79.91.203` * Gallagher API Gateway (USA): `44.193.42.111` and `3.209.194.103` * Gallagher API Gateway (Australia): `3.106.1.6` and `3.106.100.112` **Test connectivity from the server browser:** `https://commandcentre-ap-southeast-2-res.security.gallagher.cloud/health` A successful connection displays a health confirmation. If it is not displayed, there is likely a proxy or firewall blocking communication. The actual cloud address is `https://commandcentre-ap-southeast-2.security.gallagher.cloud/health` (this throws a certificate request, so the alternate URL above is used to confirm cloud operation). In later versions of Command Centre there is a **Test Connection** button on the Cloud's Advanced tab. This only verifies an HTTP path to the cloud. It does not test the secure connection. ### Specific error conditions **Error: "An existing connection was forcibly closed by the Host"** * Adding a proxy server configuration may resolve this. **Error: 403** * The Command Centre service cannot contact the cloud. Check firewall and proxy settings. **Error: "API Gateway Error: The remote certificate is invalid according to the validation procedure"** * The Gallagher Cloud uses the Sectigo Root Certificate Authority chain. * Add the following to the Command Centre server Trusted Root / Intermediate certificates: * USERTrust RSA Certification Authority * Sectigo RSA Organization Validation Secure Server CA * Reference: [Sectigo Root Certificates](https://sectigo.com/knowledge-base/detail/Sectigo-Root-Certificates/kA03l000000c4KV) **Missing DigiCert Global Root CA** * Check the server's Local Computer Trusted Root Certification Authorities using MMC. * If the **DigiCert Global Root CA** certificate is missing, the site cannot connect to the cloud. Install it before attempting any other steps. IT providers sometimes remove this certificate. **TLS 1.2 not enabled (new server or install)** * The cloud only accepts TLS 1.2 connections. * Verify using the [IIS Crypto utility](https://www.nartac.com/Products/IISCrypto/Download). **Certificate stripping (validation errors)** * If the outbound connection is being interfered with by a security appliance or virus protection stripping the certificate, validation errors will occur. ### Certificate and cloud recreation scenarios The scenarios below apply to Command Centre 8.20 and lower. **Changed the Command Centre service account:** 1. Change the user account back to the original. 2. Ensure everything works. 3. Wait until all credentials are fully registered. 4. Delete the Command Centre Cloud. 5. Change the service account. 6. Recreate the Command Centre Cloud. **Migrated to a new server (CC 8.20 or lower):** The certificate for the Mobile Cloud remains on the old server and is unavailable for verification. *If the original server is still available:* 1. Verify there are no pending invitations outstanding. 2. Delete the Command Centre Cloud on the old server. 3. Delete and then recreate the Cloud on the new server. *If the original server is not available:* 1. Find all pending invitations through a Report in the Command Centre Client and remove them. 2. Delete the Cloud service on the new server. 3. Contact Technical Support to get the Cloud service removed from the Cloud. **Restored a backup to an existing server:** * Likely caused by the Command Centre Certificate being changed after the backup was made. **Restored a backup to a new server:** * The Command Centre certificate on the new server differs from the original. Treat the same as "Migrated to a new server" above. *** 🔗 **Related** * [05. Credentials not Sending to a Client](/knowledge-hub/products/cc-hardware/credentials/mobile-connect/troubleshoot/mobile-connect-05-credentials-not-send.md). When the cloud is online but a credential does not arrive. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://help.security.gallagher.com/knowledge-hub/products/cc-hardware/credentials/mobile-connect/troubleshoot/mobile-connect-02-cloud-service-not-ac.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.