Network Troubleshooting Methodology

This is a complete example how to troubleshot network connectivity to a HOST from a station A that is working and a station B that is not working

Phase 1 – Validate Basic Connectivity

1. DNS Resolution Comparison

Run on both servers:

nslookup <Veridium_API_FQDN>

or

Resolve-DnsName <Veridium_API_FQDN>

Compare:

• Returned IP addresses

• DNS server used

• Response time

Expected:

Server A and B should resolve to exactly the same backend IP.

Possible root causes:

• Wrong DNS server

• Stale DNS cache

• Split DNS issue

• Hosts file override

Check:

type C:\Windows\System32\drivers\etc\hosts

2. Ping Test

ping <Veridium_API_FQDN>

If ICMP is blocked, continue with:

Test-NetConnection <Veridium_API_FQDN> -Port 443

Compare:

Phase 2 – Verify HTTPS Reachability

3. Browser Test

Open:

https://<Veridium_API_FQDN>/api/bopscertificate

Expected:

• May return JSON

• May return API error

• May return authentication challenge

Anything is acceptable except:

• Timeout

• Cannot connect

Document exact behavior.

4. Curl Test

On both machines:

curl -vk https://<Veridium_API_FQDN>/api/bopscertificate

Observe:

• DNS resolution

• TCP connect

• TLS handshake

• HTTP response

Compare outputs.

Phase 3 – TLS Investigation

WinHTTP timeout sometimes occurs during TLS negotiation.

5. Verify Server Certificate

From browser:

Padlock → Certificate

Compare:

• Issuer

• Subject

• SAN entries

• Expiry

Or:

openssl s_client -connect <fqdn>:443

Check if Server B can complete handshake.

6. Verify Trusted Root CAs

Run:

certlm.msc

Check:

Trusted Root Certification Authorities
Intermediate Certification Authorities

Compare with Server A.

Possible issue:

• Missing intermediate CA

• Missing root CA

• Corrupted certificate store

7. TLS Protocols

Check registry:

reg query "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols"

Compare:

• TLS 1.2 enabled

• TLS 1.3 enabled (if used)

• SSL disabled

PowerShell:

[Net.ServicePointManager]::SecurityProtocol

Phase 4 – WinHTTP and Proxy

The error is coming from:

winhttpsendrequestL 12002

This makes proxy configuration highly suspicious.

8. Check WinHTTP Proxy

On both servers:

netsh winhttp show proxy

Compare.

Common findings:

Server A:

Direct access (no proxy server)

Server B:

Proxy Server(s): xxxx

or vice versa.

9. Check Internet Explorer / System Proxy

inetcpl.cpl

Connections → LAN Settings

or:

Get-ItemProperty `
'HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings'

Compare.

10. Reset WinHTTP Proxy (if approved)

netsh winhttp reset proxy

Retest.

Phase 5 – Routing & Firewall

11. Trace Route

tracert <Veridium_API_FQDN>

Compare both machines.

Look for:

• Different routes

• MPLS path differences

• Firewall hop drops

12. Port Reachability

Test-NetConnection <Veridium_API_FQDN> -Port 443 -InformationLevel Detailed

Compare:

• Source IP

• Route

• Interface used

13. Firewall Rules

Check local firewall:

Get-NetFirewallProfile

Get-NetFirewallRule | findstr 443

Compare.

Phase 6 – Compare Network Configuration

Gather full configuration from both machines.

Server A

ipconfig /all > C:\Temp\A_ipconfig.txt
route print > C:\Temp\A_route.txt
netsh winhttp show proxy > C:\Temp\A_proxy.txt

Server B

ipconfig /all > C:\Temp\B_ipconfig.txt
route print > C:\Temp\B_route.txt
netsh winhttp show proxy > C:\Temp\B_proxy.txt

Compare:

• IP

• Gateway

• DNS

• Routing table

• Proxy

Phase 7 – Application-Level Testing

14. Call API Using PowerShell

On both servers:

Invoke-WebRequest `
-Uri "https://<Veridium_API_FQDN>/api/bopscertificate" `
-UseBasicParsing `
-TimeoutSec 60

Compare:

• Response

• Timing

• Exception

15. Enable Schannel Logging

If TLS issue suspected:

Registry:

HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL

Create:

EventLogging = 7

Reboot.

Review:

Event Viewer
Applications and Services Logs
Microsoft
Windows
Schannel

Look for:

• 36871

• 36874

• 36888

Phase 8 – Packet Capture (Most Definitive)

If all above checks appear identical.

Capture simultaneously:

On Server A

pktmon start --capture

or Wireshark.

On Server B

pktmon start --capture

Reproduce login.

Check:

This immediately reveals whether the timeout occurs at:

• DNS

• TCP connection

• TLS handshake

• HTTP layer

• Load balancer

• Reverse proxy

Last updated: August 17, 2026