> For the complete documentation index, see [llms.txt](https://docs.keeper.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.keeper.io/sso-connect-cloud/device-approvals/automator/troubleshooting.md). # Troubleshooting ### Unable to communicate with the Automator service There are several reasons why Keeper Commander is unable to communicate with your Automator service: * Ensure the Automator service is open to Keeper IP addresses. See [Ingress requirements](/sso-connect-cloud/device-approvals/automator/ingress-requirements.md). Add your IP address to troubleshoot the connection. * If you use a custom SSL certificate, ensure Automator loads it. Check the Automator logs after restarting the service. If your IP address is allowed, run this health check: ```bash curl https://automator.mycompany.com/health ``` * Check that the certificate subject name matches the FQDN. * Ensure the SSL certificate includes the CA intermediate chain. This is the most common issue. Keeper refuses connections when the intermediate chain is missing. Use `openssl` to check the chain: ```bash openssl s_client -showcerts -servername automator.company.com -connect automator.company.com ``` This command shows the certificates in the chain. One certificate means the full chain is not loaded. See **Step 4** in [Custom SSL Certificate](/sso-connect-cloud/device-approvals/automator/custom-ssl-certificate.md). ### 400 Error in Health Checks This may occur when the health check request URI differs from the SSL certificate domain. Disable SNI checks to allow the health check to complete. Set `disable_sni_check=true` in the Automator configuration. Alternatively, set the `DISABLE_SNI_CHECK` environment variable to `true`. ### Automator Service not Approving Requests Check the Automator logs to identify the potential cause of a service disruption. #### Re-run setup and initialization Run the setup and initialization sequence: ``` My Vault> automator list ID — Name — Node ID — Enabled — URL — Skills 123626338648827 — Production Keeper Automator — 123626338648102 — True — https://acaprodautomator.westus.azurecontainerapps.io — Device Approval, Team Approval, Team For User Approval My Vault> automator setup 123626338648827 Automator "Production Keeper Automator" is setup My Vault> automator init 123626338648827 Automator ID: 123626338648827 Name: Production Keeper Automator Node ID: 123626338648102 URL: https://acaprodautomator.westus.azurecontainerapps.io Version: 17.1.2.12 Enabled: Yes Skills: Device Approval : Team Approval : Team For User Approval ``` ``` Automator Settings idp_public_certificate: idp_public_certificate=xxx idp_entity_id: idp_entity_id=http://xxx idp_metadata_xml: idp_metadata_xml=.xxx sso_entity_ID: sso_entity_ID=https://keepersecurity.eu/api/rest/sso/saml/xxx saml_email_mapping: saml_email_mapping=Email email_domains: email_domains= filter_by_email_domains: filter_by_email_domains=false ssl_mode: ssl_mode=certificate disable_sni_check: disable_sni_check=false ssl_certificate_filename: ssl_certificate_filename= ssl_certificate_file_password: ssl_certificate_file_password= ssl_certificate_key_password: ssl_certificate_key_password= automator_host: automator_host=acaprodautomator.westus.azurecontainerapps.io automator_port: automator_port=443 ip_allow: ip_allow= ip_deny: ip_deny= ``` #### Resolve `NEEDS_CRYPTO` Automator in `NEEDS_CRYPTO` lacks enterprise private keys. These keys decrypt incoming SAML assertions. **Root cause** During `setup_crypto`, KeeperApp encrypts enterprise EC and RSA private keys. It uses Automator’s public key. Automator decrypts and stores them in `config/config-{automatorId}.data`. The stored data uses the master key for encryption. Without this material, Automator cannot decrypt SAML assertions. **Common triggers** * `setup_crypto` was not completed after a fresh deployment. * The `/config/` directory was lost or uses ephemeral storage. * `config/master_encryption.key` is missing or changed. * `AUTOMATOR_CONFIG_KEY` changed between restarts. * `full_reset` removed the configuration. **Diagnose the issue** Check the status endpoint: ``` GET https:///api/rest/status/{automatorId} ``` `NEEDS_CRYPTO` or `NEEDS_INIT` means crypto was not loaded or was removed. Verify the configuration files: ```bash ls -la /config/config-{automatorId}.data ls -la /config/master_encryption.key ``` **Fix the issue** Re-run `setup_crypto` with Keeper Commander: ```bash keeper automator setup --id ``` Alternatively, use **Admin Console → SSO → Automator → Edit → Setup Crypto**. This repeats the two-step EC keypair exchange. Automator then persists the enterprise keys. If `setup_crypto` continues to fail, verify: 1. The master key is persistent and not regenerated at startup. 2. `keeper.properties` does not set `persist_state=false`. 3. `/config/` uses persistent storage. #### Resolve “setup step #1 error: No response from Automator” Check the logs for `setup_cryoto is rejected..server is RUNNING`. Automator rejects setup requests while it is running. Perform a full reset, then repeat setup. ``` My Vault> automator reset My Vault> automator edit --skill=device --skill=team --skill=team_for_user My Vault> automator setup My Vault> automator init My Vault> automator enable ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.keeper.io/sso-connect-cloud/device-approvals/automator/troubleshooting.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.