Network problems are preventing M-Files from communicating with the server.

While attempting to connect the M-Files Desktop client to the cloud-hosted M-Files instance, the following error codes were encountered:

PropertyPageServerReg.cpp, 603/755 - Network problems are preventing M-Files from communicating with the server. (0x800400ED)
Item_Server.cpp, 2458 - Network problems are preventing M-Files from communicating with the server. (0x800400ED)
GrpcSession.cpp, 83 - Network problems are preventing M-Files from communicating with the server. (0x800400ED)
GrpcHandle.cpp, 97 - gRPC connection to the server failed. (0x80040159)

Upon internal investigation, it was determined that SSL/TLS inspection performed by Zscaler is interfering with the secure communication between the M-Files client and the cloud server. Specifically, the gRPC protocol used by M-Files is failing to establish a trusted connection due to certificate validation issues introduced by Zscaler’s SSL inspection.

To remediate this, the ZScaler root certificate must be trusted by the M-Files application. 

How can we achieve this ? Any specific certificate store which application is looking for other than system trusted store ?

  • Please refer to this support article: "SSL Inspection" from firewall or proxy tools can break gRPC traffic for vaults

    As it mentions, M-Files does not support these inspection tools so you should investigate if M-Files vault connections can be excluded from the SSL inspection. If you cannot find a solution by yourself, please contact Zscaler for further advice.

  • Usually every connection made inside corporate network will have similar setup. So excluding M-Files domain in SSL inspection is the only solutions to access M-Files admin/M-Files application? Is there any web version available for admin functionalities? 

  • As the support article states: M-Files does not support these tools.  That statement does not mean that it cannot work with those tools, but that we cannot provide any support on them.  Our support teams probably have no practical experience with Zscaler, and certainly do not have a breadth of experience across many such tools.

    My initial guidance would be to speak to Zscaler to see whether they have any documentation on using their SSL inspection along with gRPC traffic, which is the underlying thing which seems to be failing.  Depending upon exactly what is failing (logs within Zscaler may show more detail), I suspect that the fix will be to either install some SSL certificate from Zscaler into the client machines' SSL store (as you said), or to add the M-Files certificate into Zscaler, perhaps.  There is also the possibility that - due to the exact implementation by Zscaler - this will not work at all.

    Unfortunately the support we can offer (either via this peer-to-peer forum, or via our dedicated support teams) will likely be limited.  We'll certainly try if we can, but the reality is that the SSL inspection is causing the break and we have no control over that.

    The fallback is to whitelist that domain such that the Zscaler's SSL inspection does not break the connection.  I understand that this is not a good solution, obviously, but it's listed as a fallback in case the specific tool being used has a limitation that it cannot work with gRPC properly.

    In answer to your specific question: there are currently no web-based administrative tools available.