Symptom
Control Center reports Connection or authentication problem when trying to communicate with Management Gateway.
The client machine can clearly reach the server, but login fails anyway.
A machine that participated in the original installation connects without trouble, while a newly installed laptop or client does not.
That contrast is the diagnostic clue.
Cause
With a bootstrap installation, the Management Gateway certificate is trusted by the server installation, but nothing automatically establishes that trust on every client.
A new client must trust the public bootstrap.cert in its trusted-authorities store before authentication can proceed.
Firewall rules and tenant authorization still matter, but they produce their own failure modes. And copying random certificate or private-key files from the server until something works is not establishing a trust chain; it is scattering key material.
Fix
Copy the server's public bootstrap.cert into the client's Exstream trusted-authorities directory used by Control Center and Communications Builder.
Close all Exstream client applications and restart them before testing again; the trust store is read at startup.
Two conditions must also hold: the user has access to the target tenant on Management Gateway, and the required ports are reachable from the client.
If the installation did not use bootstrap certificates, deploy whatever the server actually uses (self-signed or commercial CA certificate) and trust that public certificate on the client. Never distribute private keys to client machines to make login work. The private key belongs to the server; clients only ever need the public certificate.
If trust is in place and the error persists, separate the failure domains: test the Management Gateway endpoint directly and read its log to distinguish certificate validation from firewall, hostname, tenant, and role problems.
Add client trust to the onboarding runbook
Certificate trust failures recur with new team members, replacement laptops, and rebuilt VMs. Document the one-time client trust step in the environment runbook.