You can use error codes and their messages to help monitor the health of your VMware Tunnel Proxy component. Learn more about the errors using their code, displayed name, and meaning to your Workspace ONE UEM Tunnel Proxy environment.
| Code | Name | Meaning |
|---|---|---|
| 0 | UNKNOWN | Unknown error. A runtime exception while processing the request |
| 1 | MISSING_HEADER | Headers are missing. This can include headers such as "Proxy-Authorization". Possible Cause: The request was stripped in transit or a bad request was sent from the application. Possible Solution: select all hops between the device and VMware Workspace ONE Tunnel to see if another network component (e.g. proxy, VPN) stripped the header. |
| 2 | WRONG_ENCODING | Proxy-Authorization header value is not Base64 encoded. Possible Cause: The request was stripped in transit or a bad request was sent from the application. Possible Solution: select all hops between the device and VMware Workspace ONE Tunnelto see if another network component (e.g. proxy, VPN) stripped the header. |
| 3 | TOKENS_DONT_MATCH | Client identification tokens in Proxy-Authorization header do not follow alg:%s;uid:%s;bundleid:%s format. ID_FORMAT should contain encryption algorithm, uid and bundleID in a specific format. One or more of these is not present. Possible Cause: The request was stripped in transit or a bad request was sent from the application. Possible Solution: select all hops between the device and VMware Workspace ONE Tunnel. |
| 4 | INVALID_ALGO | The algorithm in the Proxy-Authorization token is not supported. |
| 5 | EMPTY_CERT_CHAIN | There is no certificate present in the digital signature passed in the Proxy-Authorization header Possible Solution: select all hops for a stripped certificate. |
| 6 | SINGLE_SIGNER | Error thrown if there are multiple signers found in the certificate chain. The request is expected to be signed by only one entity. Possible Cause: A bad certificate. Possible Solution: Create another certificate with a single signer. |
| 7 | SINGLE_SIGNER_CERT | Error thrown if there are multiple certificates for signers. The VMware Workspace ONE Tunnel expects only one signer. The request signer should sign it with only one certificate. Possible Cause: A bad certificate. Possible Solution: Create another certificate with a single signer. |
| 8 | INVALID_SIGN | The signer information could not be verified. Possible Solution: Import the signer into the trusted certificate store on the server. |
| 9 | UNTRUSTED_ISSUER | The certificate used for signing wasn't issued by Device-Root of the given OG. Possible Cause: Workspace ONE UEM device root is different for enrolled OG and the OG on which VMware Workspace ONE Tunnel is configured. Possible Solutions: (1) Override the Workspace ONE UEM device root certificate and regenerate the VMware Workspace ONE Tunnel certificate. (2) Export the Workspace ONE UEM certificate from the Console or reinstall the VMware Workspace ONE Tunnel. |
| 10 | MISSING_SIGN_TIME | The signing time attribute which is used to determine potential replay attack is missing in the signature Possible Cause: A bad certificate. Possible Solution: Determine which certificate is bad in a request log. Create a correct certificate (if the cert is not a Workspace ONE UEM certificate). Rerun the VMware Workspace ONE Tunnel installer. |
| 11 | POTENTIAL_REPLAY | There is more than a 15 minute interval between signature creation by the requester (AW Browser, Wrapping, etc) and verification by VMware Workspace ONE Tunnel. |
| 12 | INVALID_SIGN_DATA | There is discrepancy in the data that was signed by the requester (AW Browser, Wrapping, etc) and what was expected to be signed by VMware Workspace ONE Tunnel. Any method other than the "CONNECT" request is sent to the VMware Workspace ONE Tunnel and is rejected. Possible Cause: An invalid request. Possible Solution: select all hops for what changed with the request at each hop. |
| 13 | DATA_UNAVAILABLE | The requester’s (AW Browser, Wrapping, etc) related data is not available with VMware Workspace ONE Tunnel even after making an API call. No data available for Udid: #####, BundleId: ####. Possible Cause: VMware Workspace ONE Tunnel does not have device details. Possible Solutions: Check the VMware Workspace ONE Tunnel to API connection. Restart the VMware Workspace ONE Tunnel service. |
| 14 | INVALID_THUMBPRINT | The thumbprint of the certificate used by the requester (AW Browser, Wrapping, etc) for signing and the one expected by VMware Workspace ONE Tunnel is different. Invalid SHA-1 thumbprint. Udid: ####, BundleId: ####. VMware Workspace ONE Tunnel expected: XYZ, Found:ABC Possible Cause: Occurs only when device is re-enrolled. Possible Solutions: Reinstall the Client (AWB, Wrapped application). Select the VMware Workspace ONE Tunnel to AWCM connection. Restart VMware Workspace ONE Tunnel Service. |
| 15 | NOT_COMPLIANT | The device making the request is not compliant (Must be in compliance states of ‘Compliant’ or ‘Not Available’). Possible Cause: VMware Workspace ONE Tunnel expected: X,Y, Found: Z Possible Solution: select the compliance status in the Device Dashboard. |
| 16 | NOT_MANAGED | The device is not managed by Workspace ONE UEM. Possible Cause: The device is not enrolled. Possible Solution: Enroll the device. |
| 17 | INVALID_CERT | The certificate used by the requester (AW Browser, Wrapping, etc) for signing is not valid (ex. signing time does not fall in the certificate lifetime). Possible Solution: Identify the invalid certificate. |
| 18 | NEED_CHUNK_AGGREGATION | Chunk aggregation is not enabled in MAG.properties file |
| 19 | HOST_DISCREPANCY | Host name in the URI does not match the one in the host header, deemed as a potential replay attack |
