Technical Support Steps

Operator steps to verify the Trust1Connector is installed correctly and working

This document helps the IT partner to investigate and perform verification steps in order for Trust1Connector to be installed correctly.

Prerequisites

The installation of the Trust1Connector has been completed successfully, but the solution is not working from the web application.

1. Environment detection

It is important to firstly detect which kind of environment is being used. The supported environments can be found at Supported Environments.

In case of Citrix XenApp, verify if the virtual application and policies are set as described at Citrix XenApp.

2. No installation detected

If the installation is not detected, follow the steps described at Installation not detected. Please use different browsers for the tests that require a browser.

Check if the installation is not detected in different browsers, some browsers require some changes. More info at Supported browsers.

3. Installation works but there are errors

Verify if the permissions are set correctly on some folders.

Verify if antivirus software is not blocked to correct functioning of the Trust1Connector.

Windows: error "Object already exists"

This error indicates that the certificate can not be created because the corresponding RSA key already exists. Normally the software detects if the key already exists but if doesn't work, perform the following steps:

Uninstall Trust1Connector
Delete the unused keys at C:\ProgramData\Microsoft\Crypto\Keys
- the following windows command can be used to find which keys are still being used, do not delete those
  $ certutil -store
Reinstall Trust1Connector (with the latest installer)
Reboot

4. Collect diagnostics and contact T1T

If the above steps do not resolve the issue, collect the diagnostics on the malfunctioning machine and provide them to T1T. Please follow the steps described at Support.

It is important to know that the first diagnostics can be retrieved on all systems (no administrator rights required) but there are some additional tools for Citrix environments (which do require administrator rights).

Additional Verifications

A1. Verify if the installation files are correctly installed

The following folders should be created after installation

Windows:
- %APPDATA%\T1T\Trust1Connector
- %TEMP%\T1T\Trust1Connector
- %PROGRAMDATA%\T1T\Trust1Connector
- %ProgramFiles%\T1T\Trust1Connector
Verify that the folderstructure is exactly as the listing underneath, additionally:
- verify t1c.json is NOT empty
- verify t1c_config.json is NOT empty and contains a checksum

C:.
└─Users
└───<USERNAME>
└─────AppData
└───────Local
└─────────Temp
└────────────T1T
         │   firewall_t1c.log
         │   t1t_backup.log
         │   t1t_restore.log
         │   uninstall_t1c.log 
         │
         └───Trust1Connector
                 t1c_55753.log
C:.
└─ProgramData
└────T1T
└─────Trust1Connector
      │   containers.json
      │   t1c.json
      │   t1c.log
      │   t1c_config.json
      │
      └───plugins
          ├───beid
          │   └───v2.1.1
          │           config.json
          │           t1c-beid-plugin-x64.dll
          │
          ├───emv
          │   └───v2.1.0
          │           config.json
          │           t1c-emv-plugin-x64.dll
          │
          ├───file-exchange
          │   └───v1.4.3
          │           config.json
          │           t1c-file-exchange-container-x64.dll
          │
          └───readerapi
              └───v2.1.0
                      config.json
                      t1c-readerapi-container-x64.dll
C:.
└─ Program Files
└────T1T
└───────Trust1Connector
           find_t1c_agent.bat
           gcl-service.exe
           gcl-service.ilk
           gcl-service.pdb
           smartcard_list.txt
           trust1connector_agent.vbs
C:.
└─ Program Files (x86)
└────T1T
└───────Trust1Connector
           find_t1c_agent.bat
           gcl-service.exe
           gcl-service.ilk
           gcl-service.pdb
           smartcard_list.txt
           trust1connector_agent.vbs

MacOS:
- ~/.t1t
  - t1c_consent.json: verify that this file contains a checksum
- /Library/Logs/T1T/Trust1Connector
  - t1c.log: verify the log file is in the folder
- /Library/LaunchAgents/com.t1t.gcld_service.plist: verify this file is provided
- /Library/LaunchDaemons/com.t1t.gcld.plist: verify this file is provided
- /Library/Application Support/T1T/Trust1Connector: verify the following files/folders are provided:
  - file_exchange.json
  - Info.plist
  - gcld
  - plugins
  - smartcard_list.txt
  - t1c.json => verify this config file is NOT empty
  - t1c_config.json => verify this config file is NOT empty
  - uninstall.sh

Remark for Windows: the %PROGRAMDATA% folder can be hidden, be sure you unhide to verify.

A2. Verify the correct configuration t1c_config.json file

In the "t1c_config.json" file verify it matches with:

{"citrix":{"enabled":true,"inactive_counter":3,"register_interval":30},"consent":{"enabled":false,"containers":["all"]},"log_level":"info","log_expose_level":"public","timeout":180}

If the configuration is not matching with the information above, please copy the file and provide it to support.

A3. Verify if the certificate has been installed correctly

MacOS:
- Open Spotlight Search (CMD + Space)
- Enter and open "Keychain Access"
- Under System, you should see the certificate "trust1connector", you search for the certificate in order to verify this easily.

Windows:
- Right click on the start button and open RUN (see screenshot below)
- Enter "mmc" and press enter
- Press File > Add/Remove Snap-in... (see screenshot below)
- Select Certificates and press Add
  - Select Computer Account
  - Select Local Computer
- Press OK
- Right click "Certificates" and press "Find Certificates..."
  - Enter "trust1connector" and press enter. You should see something similar as the screenshot below

A4. Verify the Certificate is trusted, if not add to trust list

MacOs
- Double click the certificate
- Open the "Trust" expansion panel
- Select "Always Trust"

Windows
- Find the certificate in the store (under Personal, Untrusted, Intermediate or with the search and then locate it using the information provided there).
- Drag the certificate to "Trusted Root Certificate Authorities"

A5. Verify if other tools/security tools are removing certificates or unloading services

Some administrators use tools to clean up certificate manager/keystore
- If a cleanup tool is available, the certificate and/or service must be added to the whitelist managed by the tool.
Be sure to add certificate to the whitelist of the tool that is used

A6. Verify if AntiVirus has quarantined the service

An AntiVirus application can blacklist the Trust1Connector (the technical name is 'gcld service'). When this is the case, verify if the process can be added to the white list and test again.

A7. Re-installing the service

When the above is verifies, and every step is positive, try re-installing the Trust1Connector AFTER you capture the log and config files for further elaboration at our Support Desk.

Try installing the new connector.

Please verify if the certificate is installed and valid (see below).

Try uninstalling first and after that installing the new connector.

Uninstall on windows:
- Go to Settings > Apps & Features
- Search for "Trust1Connector"
- Select "Trust1Connector" and press "Uninstall"

Uninstall on Mac:
- Execute the "uninstall.sh" script provided in the install

Please verify if the certificate is first removed after uninstalling and then added after the new installation (see below).

Check your antivirus for notifications

Check for the program "gcl-service.exe" and the service "Trust1connector" (these are both relevant to the connector). If the antivirus is blocking either, please whitelist it.

If you use Firefox

Please restart Firefox
Check the key-store of Firefox

Verify if the service is running

Open your browser and navigate to https://localhost:10443/, (see below)
If you receive a response, your connector is running and available

A8. Additionally verify from a browser that the solution is working

This is a demo/test application where you can check if your connector works.
Go to https://readmycards.eu/. The page should look similar to below. Open the admin panel to check other properties.