The authorization token generated by the Reflection for the Web management server, and required by the Reflection security proxy, was received by the proxy but either was not valid or has expired.

Possible causes

• You are attempting to reconnect your Windows-based Reflection session after your authorization token has expired.
• You are attempting to initiate a Reflection session from a settings file on your local disk instead of clicking on the web page link, and your authorization token has expired.

The proxy server does not trust the Reflection for the Web management server's security certificate.

Troubleshooting steps

1. Always start and reconnect your sessions by clicking on the Reflection for the Web link for the host and session you want.
2. Reload and/or reauthenticate to the Reflection for the Web links list page for your valid sessions.
3. Contact your Reflection for the Web system administrator for additional troubleshooting assistance.

The authorization token generated by the Reflection for the Web management server, and required by the Reflection security proxy, was not received by the proxy.

Possible causes

• You are attempting to initiate a Reflection session from a settings file on your local disk instead of clicking on the web page link.

The Reflection for the Web management server does not have a security certificate installed.

Troubleshooting steps

1. Always start and reconnect your sessions by clicking on the Reflection for the Web link for the host and session you want.
2. Reload and/or reauthenticate to the Reflection for the Web links list page for your valid sessions.
3. Contact your Reflection for the Web system administrator for additional troubleshooting assistance.

The SSL/TLS handshake failed.

Cause(s)

1. If encryption strength was explicitly set, the server may not have accepted the requested encryption strength.
2. The server does not support SSL/TLS connections.
3. You are trying to connect using the wrong host port.
4. The server is not accepting connections or is down.
5. Your server does not support the SSL/TLS version running on your Windows operating system.
6. Your client is running in FIPS mode and cannot accept the connection because the server's certificate is unsupported. The server certificate key size must meet FIPS standards for protecting the shared secret key that will be exchanged and used for encrypting the session. The host certificate key length requirements are:

   Shared Key	Host Certificate Key Requirement
   3DES (168-bit, but effectively 112-bit)	RSA or DSA key with a minimum size of 1024 bits
   AES (128-bit)	RSA or DSA key with a minimum size of 3072 bits

Troubleshooting steps

1. Select a different value for Encryption Strength, or set this to Default and try again. Check with your server's system administrator to determine the type(s) of encryption supported by the server.
2. Check with your system administrator to determine that the server is functioning properly. Disable SSL/TLS encryption in the Security Properties dialog box if you want to make an insecure connection.
3. Check the port you are using to make your connections. Reflection defaults to port 23 for Telnet connections and 1570 for VT-MGR connections. In most cases, you will need to change this value for SSL/TLS connections. Check with your system administrator to find out what port value to use for your host.
4. Check with the system administrator for system status or try connecting later.
5. Configure Reflection to connect without sending a version-specific handshake.

The SSL/TLS client failed to find user credentials. The host you are connecting to requires that you authenticate using your personal certificate, but no personal certificate was found.

Troubleshooting steps

1. If you do not have a client certificate contact your system administrator to provide you with one.
2. If you have a client certificate containing both a public and private key, you must install it to the Personal store of either the Windows Certificate store or the Reflection Certificate store.

The SSL/TLS handshake did not complete within the specified timeout period.

Cause(s)

1. Network load or slow connections did not allow the SSL/TLS handshake to complete within the timeout period. Because the SSL/TLS timeout period is comparable to the TCP/IP timeout, it is unlikely that you will encounter an SSL/TLS timeout problem without also encountering a timeout making your telnet connection.
2. Server or network is down.
3. Your server does not support the SSL/TLS version running on your Windows operating system.

Troubleshooting steps

1. It is not possible to reset the SSL/TLS timeout period.
2. Check with server or network administrator for status, or try connecting later.
3. Configure Reflection to connect without sending a version-specific handshake.

The session has been disconnected due to a corrupted message digest. The message digest is a mechanism that is used to detect whether the content of a message was changed while in transit from host to client.

Cause(s)

1. The message digest was corrupted due to a "dirty" network connection.
2. The message digest was corrupted due to an attempted hacker attack.

Troubleshooting steps

• Reestablish the network connection. Contact a network administrator if you see this error repeatedly, as it could indicate hacker activity or bad network hardware somewhere between the client and server.

The certificate presented by the server was invalid or was not issued by a certification authority (CA) trusted by this user.

Cause(s)

1. The host's server certificate is not in your Trusted Root Certification Authorities list. If you have enabled use of the Windows certificate store, you can determine which trusted certification authorities are configured for your PC using the Certificate Manager. To launch this utility, open the Windows Control Panel, double-click Internet Options, select the Content tab, then click Certificates.
2. If you have disabled use of the Windows certificate store, you may see this message if you have not yet imported certificates into the Reflection certificate store. Use the Trusted Certification Authorities tab of the Reflection Certificate Manager to manage your list of trusted CAs.
3. The host's server certificate has expired.
4. Certificate revocation checking is not returning a valid response. This message is displayed if the certificate is no longer valid. If the certificate is valid, you may see this message if Reflection is not able to reach the OCSP responder or retrieve the CRL file.

Troubleshooting steps

1. Add the certification authority to the Trusted Certificate Authority list to either the Reflection or the Windows certificate store.
2. Add the certification authority to the Trusted Certificate Authority list to the Reflection certificate store.
3. Notify the host's system administrator to acquire a new certificate.

The certificate presented by the server does not contain a host name that exactly matches the host name that you (or your definitive local security provider, such as DNS) specified as the connection target.

Before making an SSL/TLS connection, Reflection authenticates the host system. The certificate presented by the host for this purpose must be from a trusted certificate authority. If your PC does not recognize the certificate authority, you will not be able to make SSL/TLS connections.

Cause(s)

The host name you configure in Reflection must exactly match one of the host names entered in the CommonName field of the certificate.

Troubleshooting steps

If you entered an IP address instead of a host name, try entering the host name, then reconnect.

If you entered an aliased hostname (for example, "myhost"), try entering the fully qualified host name (for example, "myhost.domain.com") and then reconnect. If you are contacting a host in another domain, you must use the fully qualified host name, rather than the shortened alias name.

Contact your system administrator to determine if your certificate should include the host name. If no host name is required, open the SSL/TLS tab of the Security Properties dialog box, click Configure PKI, and clear Certificate host name must match host being contacted. Do not make this change without consulting a system administrator. If you clear this setting when host names are used, you will reduce the level of security of your connections.

You have specified a higher level of encryption algorithm strength (or are using a settings file that specifies a higher strength) than is available on your system. This will usually occur in multi-national environments, where the system administrator has specified U.S. encryption strengths, but the end user's international operating system only has export level encryption.

Troubleshooting steps

• Select a lower level of encryption strength or accept the default strength.

Rscapi.dll failed to load.

Cause(s)

1. Rscapi.dll is corrupted or missing.

Troubleshooting steps

1. Use the Microsoft Windows Installer to repair the damaged file. Use Add/Remove programs to repair your Reflection installation.

This system is missing one or more dynamic link libraries (DLLs) required for the Microsoft Cryptographic API Provider.

Cause(s)

1. Your system has corrupted versions of one or more of the Microsoft cryptographic libraries. Someone may have tampered with these files, or they may be corrupted for unknown reasons.
2. Your system does not have some or all of the required libraries. You may be using an operating system (such as Windows 95/98) which does not support access to the cryptographic libraries.

Troubleshooting steps

1. Reinstall Internet Explorer and/or your operating system to correct this problem.
2. Upgrade the operating system.

This machine is missing the Microsoft file Security.dll.

Cause(s)

1. Your system has corrupted versions of the Microsoft SSPI library. Someone may have tampered with this files, or it may be corrupted for unknown reasons.
2. Your system does not have the required Microsoft provided SSPI library. You may be using an operating system (such as Windows 95/98) which does not support access to the cryptographic libraries.

Troubleshooting steps

1. Reinstall Internet Explorer and/or your operating system to correct this problem.
2. Upgrade the operating system.

This machine is missing dynamic link libraries (DLLs) required for the Microsoft Security Service Provider Interface (SSPI).

Cause

Your system does not have the required Microsoft DLLs for access to SSPI. This indicates serious damage to one or more of your operating system files.

Troubleshooting steps

You may need to reinstall the operating system.