MOVEit Automation Web Admin — "Service is Unreachable" or Cannot Log In (Certificate & Service Troubleshooting)

Title

URL Name

MOVEit-Automation-Web-Admin-Service-Unreachable-Cannot-Login

Article Number

000207522

Environment

Product: MOVEit Automation Version: All Supported Versions OS: All Supported Platforms Other: Web Admin

Question/Problem Description

Symptoms — Is This Article for You?

You see one or more of the following when trying to log in to the MOVEit Automation Web Admin:

Login errors on the Web Admin page

"MOVEit Automation Service is Unreachable"
"Security negotiation failed: Can't create security credentials" (in debug logs)
"Invalid login or automation service is missing"
"An error occurred parsing certificate password property from property list"

Service or accessibility issues

Web Admin page loads but login fails immediately after entering valid credentials
MOVEit Automation production services are down and not coming back up
The MOVEit Automation Windows service stops or won't start
The MICAdmin service won't run and you are unable to open the web link

Common trigger contexts

The error appeared after upgrading or applying a hotfix
The error appeared after renewing or replacing an SSL certificate
The error appeared after a server rename, migration, or service-account change
The error appeared after a server reboot or service restart

⚠️ If your error says "The MOVEit Automation service is not configured to allow connections from this instance of Web Admin" or Login.fail.servernotconfiguredforthiswebadmin, see Error: "MOVEit Automation service is not configured to allow connections from this instance of Web Admin" instead — this affects versions 2025.1.5+, 2025.0.9+, and 2024.1.8+ and requires setting the "Web Admin Auth Server URL" in the Config Utility.

Steps to Reproduce

1) Go to the MOVEit Automation Web Admin Login page 2) Submit valid credentials 3) The error may present

Clarifying Information

Before You Begin

ℹ️ Two certificates, not one. MOVEit Automation uses separate SSL certificates for the Automation service (Config Utility > General tab) and the Web Admin/Tomcat (configured via server.xml). The "services certificate" warning is usually about the Automation service certificate, not the SSL cert configured for the web server. Renewing one does not fix the other.

You need Windows admin access (RDP/console) to the Automation server.
Any replacement certificate must be a PFX with the private key attached. Avoid ", @, %, $, ; in the password.

Error Message

MOVEit Automation Service is Unreachable (Login page) - work through steps below

Defect Number

Enhancement Number

Cause

There are multiple reasons why this error might occur. Based on previous instances of the issue, it may be due to an SSL certificate that is either expired or invalid for the application. If the service user for the MOVEit Automation service does not have access to the server certificate configured in the Config Utility > General tab, that can cause the issue as well. Other issues with the service will also cause the error. If it is not running, or the service user's password is not correct then logging in will not work even with valid SSL certs installed.

Resolution

Important — Before You Begin

Prerequisite checklist:

Windows admin access to the Automation server — you will need to open Windows Services, the MOVEit Automation Config Utility, and the certificate store (MMC). Log in to the server via RDP or console. If you don't have admin access, contact your IT team.
Know which account runs the MOVEit Automation service — open services.msc, find the "MOVEit Automation" service, right-click > Properties > Log On tab. Note the account name. If the password for this account was recently changed, you will need the new password.
Have the replacement SSL certificate available (if applicable) — the certificate must be in PFX format with the private key attached. If you only have a .cer, .crt, or .p7b, you need to export or re-request a PFX. Avoid special characters (", @, %, $, ;) in the certificate password.
Understand the two certificates — MOVEit Automation uses two SSL certificates: one for the Automation service (configured in Config Utility > General tab) and one for the Web Admin / Tomcat (configured during Web Admin installation or via server.xml). This article covers both. The "services certificate" warning or service-unreachable error is usually about the Automation service certificate, not the SSL cert configured for the web server.

Common misunderstandings:

"I renewed my Web Admin certificate, so everything should work." — The Automation service certificate (Config Utility > General tab) is separate. If only the Web Admin/Tomcat cert was renewed, the service cert may still be expired or misconfigured.
"The service is running, so the certificate must be fine." — If the service user's password is not correct, logging in will not work even with valid SSL certs installed. A running service does not guarantee successful authentication.
"I just upgraded and didn't change any certificates." — Upgrades and hotfixes can alter registry values or reset certificate bindings, especially if the CertIssuer and CertSerial registry values under HKEY_LOCAL_MACHINE\SOFTWARE\Standard Networks\MOVEitCentral point to a non-existing pair, which can cause the certificate field in the Config Utility to appear empty.

Choose Your Method

Method	Best For	Trade-offs
A — Quick Service & Certificate Check	Most cases: service not running, expired cert, wrong cert selected, service-account issues	Fastest; resolves ~80% of cases. No reinstallation needed.
B — Certificate Re-export & Re-import	Certificate was recently updated but appears corrupted or the Config Utility field is blank	Requires exporting the cert again and re-importing; slightly more involved.
C — Full Web Admin Reinstall	Persistent issues after patches/upgrades when Methods A & B fail	Requires the matching version installer; Web Admin goes offline during reinstall. No impact on tasks or hosts.

Resolution Steps

Method A — Quick Service & Certificate Check

1. Verify the MOVEit Automation service is running.
Open Windows Services (services.msc). Locate MOVEit Automation. If it is stopped, attempt to start it. If it fails to start, proceed to Step 4 to check logs.

⚠️ If the service account password has been changed, it needs to be updated in the Properties > Log On tab of the MOVEit Automation service before the service will start.

2. Confirm the service account has the correct permissions.
If MOVEit Automation is running with a standard Windows account (local or domain user), make sure the account is in the local Administrators group. Check via Computer Management > Local Users and Groups > Groups > Administrators. For new installs on 2025.0 and later, the service may be running under a Virtual Service Account or a Group Managed Service Account, which do not require this.

Additionally, the service account may need permission to use the certificate in order to authenticate — this can be done by adding the permission directly to the certificate via MMC (Certificates snap-in > Personal > Certificates > right-click the cert > All Tasks > Manage Private Keys).

3. Check the Automation service certificate in the Config Utility.
Open the MOVEit Automation Config Utility > General tab. (General Tab documentation)

If the certificate field is blank, a certificate must be selected. Click the ellipsis (…), expand Local Machine > My – Personal, and double-click the correct certificate.
If a certificate is shown, verify it is not expired and is in PFX format with a private key. Open MMC > Certificates (Local Computer) > Personal > Certificates to confirm expiration date and key presence.
If there are multiple certificates with the same name present in the Personal store, Automation may still be looking at an expired one.Delete any that are expired or should not be in use, then ensure the Config Utility is pointing to the correct certificate.

Click Apply > OK, then restart the MOVEit Automation service.

4. Check logs if the service won't start or the error persists.

Check the MOVEitC.log file for messages about the service failing to start. It is located at: Versions 2025.0+: C:\ProgramData\MOVEit\MOVEitAutomation | Versions 2024.1 and earlier: C:\Program Files\MOVEit\MOVEitAutomation
Check Event Viewer > Windows Logs > Application and System for entries about the MOVEit Automation service or MICentral.exe stopping or not being able to start.

5. If the service is running and restarts don't help, reboot.
If the Automation service is running and restarting it does not correct the error, reboot the system. For environments where the Web Admin is installed on a separate server, ensure that both servers are rebooted. In one situation, rebooting only the Web Admin server did not resolve the issue — rebooting the Automation server did.

ℹ️ Ensure that IPv6 is disabled on the MOVEit server. See KB 000200720 — Does MOVEit support IPv6? for instructions.

Method B — Certificate Re-export & Re-import

Use this method if the only prior change was an updated certificate causing the issue, as certificate corruption can occur. Re-export the certificate, re-import it back into the server, then update the Config Utility to point to the new certificate.

1. Re-export the certificate from its original source.
Export or re-request a PFX file (with private key) from your certificate authority or internal PKI. Ensure the export includes the full certificate chain (intermediate certificates).

⚠️ The certificate(s) chosen must be a PFX certificate with the Private key attached. Formats such as .cer, .crt, or .p7b typically lack the private key and will not work. Avoid special characters (", @, %, $, ;) in the certificate password.

2. Remove the old/corrupted certificate and import the new one.
Open MMC (mmc.exe > File > Add/Remove Snap-in > Certificates > Computer Account > Local Computer). Navigate to Personal > Certificates. If there are multiple certificates with the same name in the Personal store, delete any that are expired or should not be in use. Then right-click Personal > Certificates > All Tasks > Import to bring in the new PFX.

3. Update the Config Utility and restart.
Open the MOVEit Automation Config Utility > General tab. Click the ellipsis (…), select the freshly imported certificate, and click Apply > OK. Restart the MOVEit Automation service via services.msc.

ℹ️ If the certificate field was previously populated but users stop being able to log in and it is found that the field is now empty for an unknown reason (i.e., not manually removed), check the CertIssuer and CertSerial values to see how they are configured compared to what the certificate issuer and serial values are for the expected certificate. Correcting a mismatch in these registry values under HKEY_LOCAL_MACHINE\SOFTWARE\Standard Networks\MOVEitCentral may restore the Config Utility's certificate binding.

4. If the Web Admin (Tomcat) certificate also needs updating, follow the steps in KB 000301045 — MOVEit Automation Web Admin — SSL Certificate Expired or Expiring (How to Update or Renew). If the Web Admin certificate has expired and the same one is used in the MOVEit Automation Config Utility > General tab, that one will need to be updated as well.

5. Verify.
Open the Web Admin login page in a browser. Confirm the page loads without a certificate warning and that login succeeds with valid credentials. Clear any cached certificates in the browser if needed.

Method C — Full Web Admin Reinstall

Use this method only when Methods A and B have failed, particularly after patches or upgrades that leave the Web Admin in an inconsistent state.

1. Obtain the correct installer.
Download the full MOVEit Automation installer that matches your current installed version. If the exact version is unavailable, download the closest newer hotfix version within the same major release, then upgrade to that version first so the installer matches. See KB How do I download my MOVEit Product and License file? if needed.

2. Uninstall the Web Admin component only.
Run the installer and select Uninstall. Check only the "MOVEit Automation Web Admin" checkbox. There is NO impact to hosts, tasks, etc. if the Web Admin module is uninstalled.

3. Reinstall the Web Admin component.
Re-run the installer and select Modify. Choose "MOVEit Automation Web Admin." During installation, you will be prompted to import an SSL certificate — browse to your PFX file and enter the password. (Installation guide reference)

⚠️ The certificate must be in .pfx or .p12 format with the private key attached. .p7b files generally lack the private key and cannot be used. Avoid special characters (", @, %, $, ;) in the password.

4. Restart services and verify.
Start (or restart) both the MOVEit Automation service and the MOVEit Automation Web Admin (MICAdmin) service. Clear browser cache (Ctrl+F5) and open the Web Admin login page to confirm the certificate presents correctly and login succeeds.

ℹ️ If the MOVEit Automation server certificate in the Config Utility > General tab has expired and the same one is used in the Web Admin, that one will need to be updated as well. See this documentation page: Update the MOVEit Automation Server SSL/TLS Certificate - https://docs.progress.com/bundle/moveit-automation-web-admin-help-2026/page/Update-the-MOVEit-Automation-Server-SSLTLS-Certificate.html.

Troubleshooting — Common Issues After Certificate or Service Changes

Problem (as customers describe it)	Cause & Fix
"I followed the KB instructions but now the MICAdmin service won't start and I can't open the web link."	The Web Admin service (MICAdmin) may have lost its certificate binding or the server.xml file has incorrect paths. Verify Tomcat\conf\server.xml references the correct PFX file and password. Check file permissions: right-click server.xml > Properties > Security — ensure Administrators and SYSTEM have Full Control. Restart the MICAdmin service.
"Service is running but I still get 'Service is Unreachable' after restarting."	For environments where the Web Admin is installed on a separate server, ensure that both servers are rebooted. In one situation, rebooting only the Web Admin server did not resolve the issue — rebooting the Automation server did.
"The certificate field in the Config Utility is blank — I didn't remove it."	The CertIssuer and CertSerial registry values under HKEY_LOCAL_MACHINE\SOFTWARE\Standard Networks\MOVEitCentral may point to a non-existing pair, which can cause the certificate field in the Config Utility to appear empty. Re-select the correct certificate in Config Utility > General tab and click Apply.
"I renewed the certificate but the error came back right away."	If there are multiple certificates with the same name present in the Personal store, Automation may still be looking at an expired one. Delete expired duplicates, re-select the correct certificate in the Config Utility, and restart the service.
"I changed the service account password and now I can't log in."	The service account password needs to be updated in the properties of the MOVEit Automation service (services.msc > MOVEit Automation > Properties > Log On tab). Enter the new password, then restart the service.
"We upgraded/patched and now Web Admin won't connect — we didn't touch certificates."	Upgrades can reset certificate bindings or registry values. Open Config Utility > General tab and confirm a valid certificate is selected. If you upgraded to version 2025.1.5+, 2025.0.9+, or 2024.1.8+, check whether the error is actually "service is not configured to allow connections" — that is a different issue covered in KB 000300363.
"The Automation services certificate is expiring in 7 days — how do I find and fix it?"	This warning refers to the Automation service certificate (Config Utility > General tab), not the SSL cert configured for the web server. Follow Method B above to replace the expiring service certificate before it expires. See this documentation page for step-by-step instructions: Update the MOVEit Automation Server SSL/TLS Certificate - https://docs.progress.com/bundle/moveit-automation-web-admin-help-2026/page/Update-the-MOVEit-Automation-Server-SSLTLS-Certificate.html.
"We renamed the server and now we can't log in."	A server rename invalidates the SSL certificate's Common Name (CN) binding. You need a new certificate matching the new server name, applied to both the Automation service (Config Utility) and the Web Admin (Tomcat). Follow Methods A/B for the service cert and KB 000301045 for the Web Admin cert. A properties file that the Web Admin/Tomcat uses also needs to be updated with the new server hostname or IP address: How to modify the IP/hostname for MOVEit Automation Web Admin
"Debug logs show 'Security negotiation failed: Can't create security credentials'."	This indicates the SSL certificate for the MOVEit Automation server or Web Admin needs to be installed. The certificate(s) chosen must be a PFX certificate with the Private key attached. Follow Method B to re-import a valid certificate.
"IPv6 is enabled — could that be the issue?"	MOVEit products do not support IPv6, and having it enabled on a MOVEit server can cause various problems. To disable IPv6, in Windows, open the Local Area Connection Properties for the network interface card, and make sure the Internet Protocol Version 6 (TCP/IPv6) property is not selected.

Error Messages Addressed by This Article

Error Message	Where It Appears	Notes
MOVEit Automation Service is Unreachable	Web Admin login page	Primary error covered by this article. Multiple root causes — work through Methods A–C above.
Security negotiation failed: Can't create security credentials	Debug logs (MOVEitC.log)	Indicates a certificate issue — missing, expired, corrupt, or lacking a private key. See Method B.
An error occurred parsing certificate password property from property list	Web Admin login or service startup	Usually caused by a corrupt PFX import or special characters in the certificate password. Re-export and re-import the certificate (Method B).
Invalid login or automation service is missing	Web Admin login page	May indicate the Automation service is stopped or the service account lacks permissions. Start with Method A, Step 1.
MOVEit Automation services certificate is expiring in X day(s). Please Update.	Web Admin login page (warning banner)	This is a warning, not a blocking error — but ignoring it will eventually produce the "Unreachable" error once the certificate expires. Replace the service certificate proactively via Method B and these documentation instructions: Update the MOVEit Automation Server SSL/TLS Certificate - https://docs.progress.com/bundle/moveit-automation-web-admin-help-2026/page/Update-the-MOVEit-Automation-Server-SSLTLS-Certificate.html.

Workaround

Notes

Keyword Phrase

MOVEit Automation service is unreachable; can't login Web Admin; unable to login MIA portal; admin console not working; web admin not accessible; service unreachable after upgrade; certificate expired automation; MICAdmin service won't start; Security negotiation failed can't create security credentials; invalid login or automation service is missing; certificate password parsing error; An error occurred parsing certificate password property from property list; PFX certificate private key; Config Utility General tab certificate blank; service account password changed; server rename login fails; MOVEit Automation production services down; web admin certificate renewal login error; can not login WebAdmin after installation; application unreachable inaccessible after upgrade; PROD CENTRAL SERVER DOWN; Moveit automation services unreachable; services certificate expiring

Last Modified Date

7/2/2026 6:14 PM

MOVEit Automation Web Admin — "Service is Unreachable" or Cannot Log In (Certificate & Service Troubleshooting)

Files(0)

Was this article helpful?

Was this article helpful?

MOVEit Automation Web Admin — "Service is Unreachable" or Cannot Log In (Certificate & Service Troubleshooting)

Information

Related Articles