I've migrated a new cluster over to using the BrokerGateway and have been getting notice alarms from all the DMAs of 'Could not connect to the local NATS endpoint on '<IP>'. Please make sure that the nats service is running without issues.', doing some digging I found we were getting 'TLS handshake error: remote error: tls: bad certificate' errors in the nats-server log file, so threw together the following powershell script to to install the root ca.pem cert generated in 'C:\ProgramData\Skyline Communications\DataMiner Security' to all the DMAs machine trusted root certificate authorities, which has resolved the issue and stopped the alarms.

Can the root cert get added to the trusted root certificate authorities as part of the package installation?

$Servers = Get-Content "C:\scripts\servers.txt" | Where-Object { $_ -notmatch '^#' }

foreach ($server in $Servers) {
Write-Host ("Processing " + $server + "...")

try {
Invoke-Command -ComputerName $server -ScriptBlock {
$pemPath = "C:\ProgramData\Skyline Communications\DataMiner Security\ca.pem"

if (-not (Test-Path $pemPath)) {
Write-Warning ("[" + $env:COMPUTERNAME + "] PEM file not found at " + $pemPath)
return
}

# Read the PEM file and extract Base64
$certPem = Get-Content -Raw -Path $pemPath
$base64Lines = $certPem -split "`r?`n" | Where-Object {
($_ -notmatch "-----BEGIN CERTIFICATE-----") -and ($_ -notmatch "-----END CERTIFICATE-----")
}
$base64 = ($base64Lines -join "")
$certBytes = [Convert]::FromBase64String($base64)

# Create certificate object
$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2 -ArgumentList @(,$certBytes)
$store = New-Object System.Security.Cryptography.X509Certificates.X509Store("Root", "LocalMachine")
$store.Open("ReadWrite")

# Check if already installed
if ($store.Certificates | Where-Object { $_.Thumbprint -eq $cert.Thumbprint }) {
Write-Host ("[" + $env:COMPUTERNAME + "] Certificate already installed: " + $cert.Subject)
}
else {
$store.Add($cert)
Write-Host ("[" + $env:COMPUTERNAME + "] Installed certificate: " + $cert.Subject)
}

$store.Close()
}
}
catch {
Write-Warning ("Failed to install certificate on " + $server + " - " + $_.Exception.Message)
}
}