Client Authentication not renewed

Question

Client Authentication not renewed

Duchemin, Dominique 2,011

Hello,

How do you trace/report on certificate "Client Authentication" for the SCCM Agent expired?
130820-2021-09-09-15-50-42-memcm-client-certificate-date.png

How does the certificate change from PKI to Self-Signed? when expired?
130911-2021-09-09-16-08-24-client-cetificate-pki-or-self.png

So far the certificate self-signed are expired...
I do a New Certificate request and restart the SMS Agent Host service and the PKI pops-up

I then delete the old certificate

Any recommendations.

Thanks,
Dom

0 comments

2 answers

Your answer

Answer 1

Amandayou-MSFT 11,166

Hi @Duchemin, Dominique ，

We may navigate to CA to check for the SCCM Agent expired, instead of SCCM report.

Here is the screenshot we could refer to:

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

0 comments

Answer 2

Duchemin, Dominique 2,011

Hello,

Could we get a report from AD?

Thanks,
Dom

Amandayou-MSFT 11,166 Reputation points

2021-09-13T11:28:50.573+00:00

Hi,

We may not get the built-in report from AD, If possible, it requires the custom report to get the report we want from AD.

Here is the article about creating custom report, please refer to it:
https://systemcenterdudes.com/sccm-report-creation-report-builder/
Note: Non-Microsoft link, just for the reference.

Best regards,
Amanda
Duchemin, Dominique 2,011 Reputation points

2021-09-15T14:50:02.237+00:00
Hello,

The report https://blog.thomasmarcussen.com/using-sccm-ci-baseline-to-check-for-expiring-user-certificates/ is pointing to Users certificate and it is noted in bold "Again, the key thing here is to be sure that you deploy this CB to users and not to your systems!".

So should I change the deployment from Users to Computers as well as the path from "get-childitem -path cert:\currentuser..." in the script to "get-childitem -path cert:\LocalMachine"?

Set-Location Cert:\LocalMachine\My
Get-ChildItem -path cert:\LocalMachine\My

-ExpiringInDays failed for now checking why?
PS C:\Windows\system32> Get-ChildItem -ExpiringInDays 30 -recurse
Get-ChildItem : A parameter cannot be found that matches parameter name 'ExpiringInDays'.
At line:1 char:16

Get-ChildItem -ExpiringInDays 30 -recurse

~~~~~~~~~~~~~~~

CategoryInfo : InvalidArgument: (:) [Get-ChildItem], ParameterBindingException

FullyQualifiedErrorId : NamedParameterNotFound,Microsoft.PowerShell.Commands.GetChildItemCommand

I will try
get-childitem -path Cert:\LocalMachine\My -recurse | where { $_.notafter -le (get-date).AddDays(624)}

Thanks,
Dom
Amandayou-MSFT 11,166 Reputation points

2021-09-17T09:40:05.933+00:00

Hi,

Thanks for your update.

We could try this method, this article is not from Microsoft, so it is recommended that we use the custom script to achieve this target.

Thanks for your understanding.

Best regards,
Amanda

Share via

Client Authentication not renewed

2 answers

Your answer