> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/continuous-delivery/use-continuous-delivery/deploy-services-on-different-platforms/traditional/ssh-winrm-faqs.md).

# SSH and WinRM FAQs

Answers to common questions about SSH and WinRM deployments in Harness.

This page answers common questions about SSH and WinRM deployments in Harness.

***

## Secrets and connectors

<details>

<summary>How are Harness secrets tied to a connector, and what should I watch for?</summary>

Connectors are often tied to a secret, such as a password or an SSH key, that can expire. An expired secret is a common cause of execution failures that surface as connector errors. Rotate the secret before it expires to avoid deployment failures.

</details>

<details>

<summary>Is it possible to use EdDSA keys with Harness Git?</summary>

Yes, Harness supports the ed25519 key. Use the following command to generate the key:

```bash
ssh-keygen -t ed25519 -b 256 -f /Users/test/Documents/temp/edd -m pem
```

</details>

***

## Deployment configuration

<details>

<summary>How do I deploy an Azure Spring Apps JAR using Harness CD?</summary>

Use an SSH deployment and include a step to download the JAR.

</details>

<details>

<summary>Does Harness support SSH deployments using the GCP connector, like it does for AWS and Azure?</summary>

No, this feature is not yet supported. Use an SSH key, or a user name and password, with a data center connector as an alternative.

</details>

<details>

<summary>Can I use the Command step in a Custom stage?</summary>

No, the Command step is only applicable in SSH and WinRM type deployments, so it is not supported in a Custom stage.

</details>

<details>

<summary>Is there a way to implement a percentage-based rolling strategy for Shell Script hosts?</summary>

For a rolling strategy, you specify the number of instances to deploy per phase. If you have multiple target hosts in a stage and want to deploy a certain proportion of instances per phase, you can configure the number of instances per phase as either a count or a percentage. For more information, see [SSH and WinRM deployments](/continuous-delivery/use-continuous-delivery/deploy-services-on-different-platforms/traditional/ssh-ng.md#rolling).

</details>

<details>

<summary>Does Harness support automatic rollback for SSH and WinRM deployment types?</summary>

No. Write a custom script that retrieves the previous version and creates a new forward deployment with the required version of the artifact and the manifest.

</details>

<details>

<summary>How do I reference privateIp for an EC2 instance in an SSH type deployment?</summary>

Use `<+instance.properties.privateIp>` to reference the private IP. All available variables under instance properties follow the same pattern. Print `<+instance.properties.*>` to confirm the full list.

</details>

<details>

<summary>Does Harness create the target directory for config file copy or artifact download if it does not exist?</summary>

No. Harness does not create the directory if it does not exist. Ensure that the path you provide already exists on the target host.

</details>

***

## Service licensing

<details>

<summary>How does Harness detect service licenses for SSH deployments?</summary>

For more information, see [Service licensing for CD](/continuous-delivery/troubleshooting-and-resources/resources/service-licensing-for-cd.md#ssh-and-winrm).

</details>

***

## Command step errors

<details>

<summary>Why am I getting the error "Host information is missing in Command Step"?</summary>

The error message is:

```
Invalid argument(s): Host information is missing in Command Step. Please make sure the looping strategy (repeat) is provided.
```

If you use the Command step, the `Repeat` looping strategy is required. This error indicates that the Command step ran without a `Repeat` looping strategy. To fix this, set the `Repeat` looping strategy for the Command step. For more information on the Command step and the supported looping strategies, go to [SSH and WinRM](/continuous-delivery/use-continuous-delivery/cd-building-blocks/cd-steps/utilities/download-and-copy-artifacts-using-the-command-step.md#ssh-and-winrm).

</details>

***

## WinRM configuration and troubleshooting

<details>

<summary>Why is downloading an artifact for WinRM from Nexus not working when the Windows machine is behind a proxy?</summary>

Nexus is supported. Use a custom PowerShell script similar to the following:

```powershell
Invoke-WebRequest -Uri "${URI}" -Headers $Headers -OutFile "${OUT_FILE}" -Proxy "$env:HTTP_PROXY"
```

</details>

<details>

<summary>How do I give a user access to WinRM resources?</summary>

Run the command `winrm configSDDL default`. This opens a dialog box where you can check whether the user configured for login is already present, and add the user if it is not.

</details>

<details>

<summary>How do I enable certificate authentication for WinRM?</summary>

Certificate authentication is disabled by default. Run the following command to enable it:

```powershell
Set-Item -Path WSMan:\localhost\Service\Auth\Certificate -Value $true
```

</details>

<details>

<summary>How do I fix the error "Socket Connection Failed for url windowshost on port 5985"?</summary>

Check whether port 5985 is open, and test communication for WinRM on that port.

</details>

<details>

<summary>Can I create a WinRM credential using Terraform?</summary>

Yes. Automate creating a WinRM credential or secret key using the [Harness Secrets API](https://apidocs.harness.io/tag/Account-Secret#operation/create-account-scoped-secret).

</details>

<details>

<summary>How do I install artifacts on IIS on a Windows VM?</summary>

Use the Copy or Download command option. Create a WinRM connection and deploy the artifact to the Windows VM.

</details>

<details>

<summary>Is it possible to add multiple realms when configuring WinRM using Kerberos?</summary>

No. You can provide only one realm per WinRM credential. To add more realms, create additional WinRM credentials.

</details>

<details>

<summary>Why is WinRM execution failing with the error below?</summary>

The error message is:

```
Command execution failed. Error: HTTP response '403: URLBlocked' when communicating with <<host>>
```

Check whether the Windows machine is behind a proxy, and configure the same proxy on the delegate host.

</details>

{% @harness-feedback/feedback %}