Skip to content

Control Center cannot authenticate to Management Gateway: trusting bootstrap.cert

Historical eraExstream 16.6 / 23.3 client-server trust

By Tomas Hajek, working with Exstream since 2008. Published 2026-03-27

Applies to: Exstream 16.6 and 23.3 Communications Server deployments using bootstrap or self-signed certificates.

Symptom

Control Center reports Connection or authentication problem when trying to communicate with Management Gateway. The client machine can clearly reach the server, but login fails anyway. A machine that participated in the original installation connects without trouble, while a newly installed laptop or client does not. That contrast is the diagnostic clue.

Cause

With a bootstrap installation, the Management Gateway certificate is trusted by the server installation, but nothing automatically establishes that trust on every client. A new client must trust the public bootstrap.cert in its trusted-authorities store before authentication can proceed.

Firewall rules and tenant authorization still matter, but they produce their own failure modes. And copying random certificate or private-key files from the server until something works is not establishing a trust chain; it is scattering key material.

Fix

Copy the server's public bootstrap.cert into the client's Exstream trusted-authorities directory used by Control Center and Communications Builder. Close all Exstream client applications and restart them before testing again; the trust store is read at startup.

Two conditions must also hold: the user has access to the target tenant on Management Gateway, and the required ports are reachable from the client.

If the installation did not use bootstrap certificates, deploy whatever the server actually uses (self-signed or commercial CA certificate) and trust that public certificate on the client. Never distribute private keys to client machines to make login work. The private key belongs to the server; clients only ever need the public certificate.

If trust is in place and the error persists, separate the failure domains: test the Management Gateway endpoint directly and read its log to distinguish certificate validation from firewall, hostname, tenant, and role problems.

Add client trust to the onboarding runbook

Certificate trust failures recur with new team members, replacement laptops, and rebuilt VMs. Document the one-time client trust step in the environment runbook.

Related Exstream notes.

Resolve can check the pattern against your environment.

Resolve searches your approved sources and shows its citations. If the evidence is weak, the same case reaches an experienced Exstream specialist with the evidence attached.

These articles describe field experience and identify the Exstream versions they cover. They are not official vendor guidance. CCMForge is independent and is not affiliated with or endorsed by OpenText. OpenText and Exstream are trademarks of their respective owner.