Issue Description
While deploying Self Service+ to computers, the installation may fail with an error similar to the following:
error in downloadFileFromURL = Connection failure: "The network connection was lost."
The download of /Library/Application Support/JAMF/tmp/SelfServicePlusInstaller.pkg failed.
error in downloadFileFromURL = Connection failure: "The operation couldn't be completed. ( error 403.)"
This occurs when the device cannot reach the required Jamf endpoints to download the Self Service+ installer. The two most common causes are:
Required domains are not safelisted on the network firewall or proxy.
SSL Inspection is intercepting HTTPS traffic to Jamf endpoints.
Troubleshooting Steps
Step 1: Test Connectivity and Check for SSL Inspection
Run the following commands on an affected device. The output will confirm whether the endpoints are reachable and whether SSL Inspection is intercepting the connection:
/usr/bin/curl -v https://nom.telemetrydeck.com 2>&1 | grep -E "SSL|certificate|issuer|403|Connected|Failed"
/usr/bin/curl -v https://app.launchdarkly.com 2>&1 | grep -E "SSL|certificate|issuer|403|Connected|Failed"
/usr/bin/curl -v https://mobile.launchdarkly.com 2>&1 | grep -E "SSL|certificate|issuer|403|Connected|Failed"
/usr/bin/curl -v https://clientstream.launchdarkly.com 2>&1 | grep -E "SSL|certificate|issuer|403|Connected|Failed"
/usr/bin/curl -v https://packages.soup.services.jamfcloud.com/selfservice-plus 2>&1 | grep -E "SSL|certificate|issuer|403|Connected|Failed"
/usr/bin/curl -v https://packages.soup.services.jamfcloud.com/selfservice-plus-uninstaller 2>&1 | grep -E "SSL|certificate|issuer|403|Connected|Failed"
Step 2: Interpret the Output
If the connection is successful and SSL Inspection is not present, the certificate issuer will reference Amazon. This is the expected result, as Jamf uses Amazon CloudFront for package delivery:
* Connected to packages.soup.services.jamfcloud.com port 443
* SSL connection using TLSv1.3 / AEAD-AES128-GCM-SHA256
* Server certificate:
* issuer: C=US; O=Amazon; CN=Amazon RSA 2048 M01
* SSL certificate verify ok.If the certificate issuer shows a corporate or proxy CA (such as Zscaler, Palo Alto, or an internal CA) instead of Amazon, SSL Inspection is intercepting the connection. This will need to be resolved before Self Service+ can be installed successfully:
* Connected to packages.soup.services.jamfcloud.com port 443
* SSL connection using TLSv1.3 / AEAD-AES256-GCM-SHA384
* Server certificate:
* issuer: O=Example Corp; CN=corporate-proxy.example.com
* SSL certificate verify ok.If the output shows
Failedor a403error and no successful connection is established, the required domains are likely being blocked at the firewall or proxy level. The domains will need to be safelisted before Self Service+ can be installed successfully.
Step 3: Resolution
If SSL Inspection is the cause:
Work with your network or security team to create an SSL Inspection Bypass (also called an SSL Inspection exclusion or "Do Not Inspect" rule) for the Jamf-related domains listed below.
Ensure the bypass applies to all domains listed in the table in the section below.
Have the device check in again to retry the Self Service+ installation.
If the domains are blocked:
Work with your network or firewall team to safelist the following domains on port 443:
nom.telemetrydeck.comapp.launchdarkly.commobile.launchdarkly.comclientstream.launchdarkly.compackages.soup.services.jamfcloud.com/selfservice-pluspackages.soup.services.jamfcloud.com/selfservice-plus-uninstaller
Once the domains are safelisted, have the device check in again to retry the Self Service+ installation.