Clients not communicating with CMG

Question

Hi,

I'm trying to setup a CMG and I'm using PKI certs. I've deployed the proper certificates to the CMG and can see that they are bound in the Azure VM. I'm not using a CRL, so I unchecked those options on the CMG installation wizard and my site properties. When I use the CMG connection analyzer, everything looks good.

However, when I try to use a client pointing to that CMG, I see the following in my LocationServices.log file

What certificate is missing and how do I apply it?

Thanks!

Answer 1

We had the same symptoms as the original post after configuring our CMG. After working with MS it ended up being an enabled setting that didn't actually apply in the registry. We had the boxed checked for "Allow Configuration Manager cloud management gateway traffic" in the settings of our Management Point but for some reason it didn't update the registry and CMG traffic was still being blocked. We unchecked the box, hit apply, rechecked the box, hit apply again, at which point the registry updated correctly and our CMG started to work as expected. The specific key for us was HKLM\SOFTWARE\Microsoft\SMS\MP\EnableInternet and needs to equal DWORD of 1. We are running SCCM CB 1910.

Answer 2

We are experiencing this same issue. The suggestions provided did not resolve it. How did you get this resolved?

Answer 3

Hi Rahul,

I tried, but my client auth certs don't export the private key, so I can't even start the connection analyzer with the cert. Is it wise to modify the template so I can export the key?

Answer 4

Have you tried running the connection analyzer using the Client auth cert? Also, where is your CMG connection point installed?

Answer 5

Hi,

Thanks for your reply.

Please also uncheck the option "Verify Client Certificate Revocation" on the settings tab of the CMG connection point properties. As shown below:

Thanks for your time.

Best regards,
Simon

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.