Troubleshooting the installation

Install Decision in an existing Hub environment

We didn't add Decision when we installed/upgraded Hub to 4.7, but we now want to use it. How do we install it?

You will need to carry out the steps in Generate an SSL Certificate and Install the Blue Prism Decision Model Service. Then you need to update the Hub appsetting.json file with the Decision connection strings.

The information below describes updating the Hub appsettings.json file. Caution must be taken to only amend the information provided, any other changes may break your existing system. Changes to the appsettings.json file should be made in conjunction with Blue Prism to ensure your system is supported.

To update the appsetting.json file to include Decision:

  1. Open Windows Explorer and navigate to C:\Program Files (x86)\Blue Prism\Hub\appsettings.json.

    This is the default install location – adjust this if you have used a custom location.

  2. Open the appsettings.json file in a text editor.
  3. Locate the following section of the file:

    "BluePrismDecision": {
        "ConnectionString": "",

    This is not the only setting you will see under BluePrismDecision. However, it is the only one that needs to be changed.

  4. Using the Blue Prism Data Protector Tool in PowerShell, create and encrypt the connection string for the Decision database, for example:

    If you want to use SQL Authentication:

    .\BluePrismDataProtector.Console.exe protect -v "Data Source=[SQL Server];Initial Catalog=BluePrismDecisionDB;User Id=[user name, for example, sqladmin];Password=[password];Max Pool Size=500;MultiSubnetFailover=True;" -p ".\"

    If you want to use Windows Authentication:

    .\BluePrismDataProtector.Console.exe protect -v "Data Source=[SQL Server];Initial Catalog=BluePrismDecisionDB;Integrated Security=True;Max Pool Size=500;MultiSubnetFailover=True;" -p ".\"

    Where you replace:

    [SQL Server] = The SQL Server that will host the database.

    [user name, for example, sqladmin] = The SQL user name (SQL Authentication only)

    [password] = The password for the SQL user (SQL Authentication only)

    If required, you can enter a different database name for the Initial Catalog parameter. BluePrismDecisionDB is the default name.

    The settings above are equivalent to the values you would enter on the Configure Blue Prism Decision SQL connection screen in the Hub Install Wizard.

    The Decision database will be created when you install the Decision plugin in Hub.

  5. Copy the encrypted string between the "" next to the ConnectionString setting in the Hub appsettings.json file, shown in step 3.
  6. Save the file.
  7. Locate the following section in the same appsettings.json file:

    "BluePrismDecisionSettings": {
        "Certificate": {
            "CertificateThumbprint": ""
        "DruidModelServices": {
            "v1": ""
  8. Between the "" next to the CertificateThumbprint setting, enter the thumbprint for the SSL certificate.

    If you are using Windows, you can find this using Manage Computer Certificates, double-click the Certificate and Thumbprint is on the Details tab.

  9. Between the "" next to the v1 setting, enter the URL for the Blue Prism Decision Model Service.
  10. Save and close the file.
  11. Restart Hub:

    1. Open Internet Information Services (IIS) Manager.

    2. In the list of connections, select Blue Prism - Hub.

      This is the default site name – if you have used a custom site name, select the appropriate connection.

    3. Click Restart from the Manage Website controls.

  12. Add Decision to the hosts file. For more information, see Decision DNS resolution.

The next steps are to complete Install the Decision plugin and Configure access to the Decision plugin. However, before you install the plugin, you will need to temporarily provide dbcreator or sysadmin SQL Server permissions to the login used for the Application Pool Blue Prism – Hub, this login will depend on the option selected when you installed Hub:

  • SQL Server Authentication – The SQL user who was specified during the install.
  • Windows Authentication – The Windows service account associated with the Application Pool Blue Prism – Hub.

The Decision database is created when the Decision plugin is installed in Hub. After this, the dbcreator or sysadmin permissions can be removed.

OpenSSL script fails

If the OpenSSL script fails, add OpenSSL to Path environment variable and then try running the script again.

  1. From the Windows taskbar, open Control Panel.
  2. Select System and Security, then select System, and then click Advanced system settings.

    The System Properties dialog displays.

  3. Click Environmental variables.

    The Environment Variables dialog displays.

  4. In the System variables group, select Path, and then click Edit.

    The Edit environment variable dialog displays.

  5. Click New and on the new line, enter the path to OpenSSL. The default location is C:\Program Files\OpenSSL-Win64\bin.
  6. Click OK to save the changes.

500 error received when using Decision

This error may be seen if you are running the Decision Model Service as a Windows service on a different server to Blue Prism Hub. It indicates that communication between the servers cannot be established and is most likely due to a firewall. You need to allow requests on the port where the Decision Model Service is running to establish communication. The way to do this will depend upon the firewall you are using. The example below describes how to create an Inbound Rule for the Windows Defender Firewall:

  1. Open the Group Policy Management Console to Windows Defender Firewall with Advanced Security.

  2. In the navigation pane, click Inbound Rules.

  3. Click Action, and then click New rule.

    The New Inbound Rule Wizard displays.

  4. On the Rule Type page, select Port, and click Next.

  5. On the Protocols and Ports page, select TCP and enter the port that is configured for Decision Model Service, for example, 50051, and then click Next.
  6. On the Action page, select Allow the connection, and then click Next.
  7. On the Profiles page, select the network location types that should be allowed to access the service, and then click Next.
  8. On the Name page, enter a name and a description that allows easy identification of the rule, for example, Allow Decision Model Service Connection and then click Finish.