I'm on Windows 2008R2
I port forwarded TCP 4703 to my NetXMS server on my firewall
NetXMS server program is already added to Windows firewall (but check on this)
I have a Linux Mint Virtualbox that i used for the openssl commands. Windows openssl I imagine would work, but I had the Linux box and it was faster than formatting the provided openssl.conf files to a Windows install.
Follow creating the root pair as shown here:
https://jamielinux.com/docs/openssl-certificate-authority/create-the-root-pair.html
Make sure you copy the config file from the Appendix as it is says in the directions
Follow creating the intermediate pair as shown here:
https://jamielinux.com/docs/openssl-certificate-authority/create-the-intermediate-pair.html
Make sure you copy the config file from the Appendix as it is says in the directions
When it says chmod 400, I did 444, so I could edit the files (later step)
You do not need to create the certificate chain file, as it will not be used (I tried, it doesn't work)
Edit the intermediate.cert.pem file and add the text from the intermediate.key.pem at the bottom so you have
-----BEGIN CERTIFICATE-----
stuff
-----END CERTIFICATE-----
-----BEGIN RSA PRIVATE KEY-----
stuff
-----END RSA PRIVATE KEY-----
I think you need a blank line at the end of the pem files. So make sure can put the cursor down under the -----END RSA PRIVATE KEY----- indicating there is a blank line there
Copy ca.cert.pem and intermediate.cert.pem to your NetXMS server. I put them in D:\NetXMS\etc\cert
Add the following to netxmsd.conf
ServerCACertificate = D:\NetXMS\etc\cert\ca.cert.pem
ServerCertificate = D:\NetXMS\etc\cert\intermediate.cert.pem
ServerCertificatePassword = secretpassword
Restart the NetXMS Core service

On the node/agent add the following to the nxagentd.conf where the x's are your public IP (or whatever the nodes will be tunneling to)
MasterServers = xxx.xxx.xxx.xxx
ServerConnection = xxx.xxx.xxx.xxx
Restart the NetXMS Agent service

In NetXMS Management Console go to Configuration/Agent Tunnel Manager. You should see the Unbound tunnel. Right click and create node and bind. I left the Primary host name blank. Although I have seen posts where you set it to 0.0.0.0 or the IP of the agent (not sure if that is the public or the local IP). When I set it to 0.0.0.0 it changes the name to not what I want. I left it blank, it has been working and I get the name I set.

Most of what I have here isn't new. I just consolidated it into one place.
This post was a big help https://www.netxms.org/forum/configuration/agent-to-server-connections/msg22308/#msg22308

On the NetXMS server, I did the following:
openssl genrsa -out rootCA.key 2048
openssl req -config "C:\Program Files (x86)\GnuWin32\share\openssl.cnf" -x509 -new -key rootCA.key -days 2038 -out rootCA.crt
openssl genrsa -out server.key 2048
openssl req -config "C:\Program Files (x86)\GnuWin32\share\openssl.cnf" -new -key server.key -out server.csr
openssl x509 -req -in server.csr -CA rootca.crt -CAkey rootca.key -CAcreateserial -out server.crt -days 2038

I placed rootCA.crt, server.crt, and server.key into D:\NetXMS\etc\cert

I added the following to netxmsd.conf and restarted the NetXMS core service

ServerCACertificate = D:\NetXMS\etc\cert\rootCA.crt
ServerCertificate = D:\NetXMS\etc\cert\server.crt
ServerCertificateKey = D:\NetXMS\etc\cert\server.key

On the agent I have the following in the nxagentd config file

MasterServers = 172.16.0.47
ServerConnection = 24.xx.xxx.xxx

The agent connects to the server and I see the tunnel in the tunnel manager. After I bind the tunnel to a node, I get the TLS handshake failed error. My log messages appear in the agent log just as posted by danny.richardson.

do you have other tunnels working? It could be certificate validation issue - you can check tunnel log on server side for more information.

Best regards,
Victor