Splitting Airwatch Components - Cloud Connector is not running correctly

[sbenkel]

Hello everybody,

we have the following situation: (Airwatch Version 21.09 - OnPrem)

Airwatch Console and Device Services Server (+AWCM) is installed on the same machine (ServerInternal1).

Now we set up an extra Device Services Server to split the services so that the AWCM Service is running on an extra DMZ server. So we installed a new Device Services Server with AWCM in the DMZ additionally (ServerDMZ1).

After that we installed the Secure Channel installer on the new Device Services Server (ServerDMZ1). Like mentioned in the officially airwatch article: https://docs.vmware.com/en/VMware-Workspace-ONE-UEM/services/AirWatchCloudConnector/GUID-AWT-INSTALL-SUPERTASK.html

After that we also installed a Airwatch Cloud Connector on an internal Server (ServerIntenal2) to get the infrastructure complete installed. The Cloud Connector Service is running on the Cloud Connector Server: But we get different Error Message after checking the Cloud Connector log - debending on which AWCM Adress we want to connect to:  Failed to send Idle message to AWCM: https://mdm.myurl.de:2001/awcm

When we try to access the AWCM Service from the Cloud connector it shows "OK" without any certificate issues: https://mdm.myurl.de:2001/awcm/status "OK"

when we access the URL of the Device Services Server AWCM Address of the new Device Services Server in the DMZ from the new installed Cloud Connector we also get "OK" status but Cert Issues (Not secure) https://10.8.xx.xx:2001/awcm/status "OK"

When we check the cloud connector status in the airwatch console we get the following message: "AWCM Error Message: Senders Certificate Not Trusted: ServerInternal1.lswdom.local (Settings with old Device Services Server ServerInternal1 as AWCM URL)

"The AWCM servers SSL Certificate is not trusted" (Settings with new Device Services Server in DMZ - ServerDMZ1)

Is there anything i need to take care of that hasn't been done right now? Exchange Certificates from the Cloud Connector to Console or Device Services Server or check correct Certificate Bindings somewhere?

My goal is that the Cloud Connector is communicating with the new set up Device Services Server in the DMZ. But right now the Cloud connector cant communicate neither with the current console server (AWCM running) or the device server + (AWCM also running).

Doesnt matter which URL im editing in the Site URLS for AWCM Service - Cloud Connector Cant connect correctly and is bringing the AWCM Error Messages.

Secure Channel installer has been installed correct on Device Services Server in DMZ bevore installing Cloud Connector

Does anyone know a solution or have a tip for me where to check again?

Best wishes

Sven