CMG connection not working after restore

Question

CMG connection not working after restore

JG 396

I have just done a restore of ConfigMgr and the CMG isnt working-

I stopped the CMG from the console but it remains at "stopping".

It was then restarted in Azure and is healthy

Ive checked the secret keys and the 2 set for WebAppCMG and ConfigMgrSvc are valid for another 8 months

i have done a Get-CMGetCloudManagementGateway -Name "cmgname" from the console powershell but it returns nothing.

any ideas what to do next please?

Thanks

User's image

smsadminui.log

at Microsoft.ConfigurationManagement.AdminConsole.AzureServices.CMGAnalyzer.backgroundWorker_DoWork(Object sender, DoWorkEventArgs e)\r\n

[19, PID:6448][12/12/2023 12:45:28] :System.Net.WebException\r\nThe remote server returned an error: (500) Internal Server Error.\r\n at System.Net.HttpWebRequest.GetResponse()

at Microsoft.ConfigurationManagement.AdminConsole.AzureServices.CMGAnalyzer.backgroundWorker_DoWork(Object sender, DoWorkEventArgs e)\r\n

cloudmgr.log

Starting to collect analytics data CMG. SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:44:02 13536 (0x34E0)

Resource Manager - Initializing... Acquiring access token to resource manager and accessing the subscription SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:44:02 13536 (0x34E0)

TaskManager: 1 task(s) running, 0 task(s) waiting to start. SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:44:02 2800 (0x0AF0)

TaskManager: Task [AnalyticsCollectionTask: Service CMG] status is Faulted SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:44:02 2800 (0x0AF0)

TaskManager: Removing task [AnalyticsCollectionTask: Service CMG] from running tasks. SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:44:02 2800 (0x0AF0)

ERROR: TaskManager: Task [AnalyticsCollectionTask: Service CMG] has failed. Exception System.ArgumentNullException, Value cannot be null.~~Parameter name: clientSecret. SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:44:02 2800 (0x0AF0)

TaskManager: Retrying task [AnalyticsCollectionTask: Service CMG], number of retries left: 1. SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:44:02 2800 (0x0AF0)

TaskWorker: Starting task: [AnalyticsCollectionTask: Service CMG] SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:44:02 12304 (0x3010)

Starting to collect analytics data CMG. SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:44:02 6824 (0x1AA8)

Resource Manager - Initializing... Acquiring access token to resource manager and accessing the subscription SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:44:02 6824 (0x1AA8)

SetTaskState: Task 16777218 State Failed. SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:44:02 6824 (0x1AA8)

TaskManager: 1 task(s) running, 0 task(s) waiting to start. SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:44:02 2800 (0x0AF0)

TaskManager: Task [AnalyticsCollectionTask: Service CMG] status is Faulted SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:44:02 2800 (0x0AF0)

TaskManager: Removing task [AnalyticsCollectionTask: Service CMG] from running tasks. SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:44:02 2800 (0x0AF0)

ERROR: TaskManager: Task [AnalyticsCollectionTask: Service CMG] has failed. Exception System.ArgumentNullException, Value cannot be null.~~Parameter name: clientSecret. SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:44:02 2800 (0x0AF0)

TaskManager: Task [AnalyticsCollectionTask: Service CMG] has faulted and will not be retried. SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:44:02 2800 (0x0AF0)

Start to poll cloud service tasks from DB SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:45:01 7704 (0x1E18)

TaskWorker: Starting task: [CloudServicesTaskBuilder] SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:45:01 12304 (0x3010)

CloudServicesTaskBuilder: Starting. SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:45:01 9640 (0x25A8)

TaskManager: 0 task(s) running, 0 task(s) waiting to start. SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:45:01 2800 (0x0AF0)

TaskManager: Task [CloudServicesTaskBuilder] status is Running SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:45:01 2800 (0x0AF0)

CloudServicesTaskBuilder: Stopping. SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:45:02 9640 (0x25A8)

TaskManager: 1 task(s) running, 0 task(s) waiting to start. SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:45:02 2800 (0x0AF0)

TaskManager: Task [CloudServicesTaskBuilder] status is RanToCompletion SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:45:02 2800 (0x0AF0)

TaskManager: Removing task [CloudServicesTaskBuilder] from running tasks. SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:45:02 2800 (0x0AF0)

Start to poll cloud service tasks from DB SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:46:01 5532 (0x159C)

TaskManager: 0 task(s) running, 0 task(s) waiting to start. SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:46:01 2800 (0x0AF0)

TaskWorker: Starting task: [CloudServicesTaskBuilder] SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:46:01 12304 (0x3010)

CloudServicesTaskBuilder: Starting. SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:46:01 5532 (0x159C)

CloudServicesTaskBuilder: Stopping. SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:46:02 5532 (0x159C)

TaskManager: 1 task(s) running, 0 task(s) waiting to start. SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:46:02 2800 (0x0AF0)

TaskManager: Task [CloudServicesTaskBuilder] status is RanToCompletion SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:46:02 2800 (0x0AF0)

TaskManager: Removing task [CloudServicesTaskBuilder] from running tasks. SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:46:02 2800 (0x0AF0)

Start to poll cloud service tasks from DB SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:47:01 5532 (0x159C)

TaskManager: 0 task(s) running, 1 task(s) waiting to start. SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:47:01 2800 (0x0AF0)

TaskWorker: Starting task: [CloudServicesTaskBuilder] SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:47:01 12304 (0x3010)

CloudServicesTaskBuilder: Starting. SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:47:01 5532 (0x159C)

CloudServicesTaskBuilder: Stopping. SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:47:02 5532 (0x159C)

TaskManager: 1 task(s) running, 0 task(s) waiting to start. SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:47:02 2800 (0x0AF0)

TaskManager: Task [CloudServicesTaskBuilder] status is RanToCompletion SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:47:02 2800 (0x0AF0)

TaskManager: Removing task [CloudServicesTaskBuilder] from running tasks. SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:47:02 2800 (0x0AF0)

Start to poll cloud service tasks from DB SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:48:01 9640 (0x25A8)

TaskManager: 0 task(s) running, 0 task(s) waiting to start. SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:48:02 2800 (0x0AF0)

Current CMG deployment package hash is 7GSkibYNOs= SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:48:02 9640 (0x25A8)

Current VMSS CMG deployment package hash is 3tkq8J0/MeOmU= SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:48:02 9640 (0x25A8)

CreateUpgradeTaskForPackageChange: Triggered to create upgrade task for service type CloudProxyService with current package hash 7GSkAFUibRzMNOs=. SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:48:02 9640 (0x25A8)

TaskManager: 0 task(s) running, 0 task(s) waiting to start. SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:48:02 2800 (0x0AF0)

TaskWorker: Starting task: [CloudServicesTaskBuilder] SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:48:02 12304 (0x3010)

CloudServicesTaskBuilder: Starting. SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:48:02 9640 (0x25A8)

CloudServicesTaskBuilder: Stopping. SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:48:02 9640 (0x25A8)

TaskManager: 1 task(s) running, 0 task(s) waiting to start. SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:48:02 2800 (0x0AF0)

TaskManager: Task [CloudServicesTaskBuilder] status is RanToCompletion SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:48:02 2800 (0x0AF0)

TaskManager: Removing task [CloudServicesTaskBuilder] from running tasks. SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:48:02 2800 (0x0AF0)

Start to poll cloud service tasks from DB SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:49:01 5536 (0x15A0)

TaskManager: 0 task(s) running, 0 task(s) waiting to start. SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:49:01 2800 (0x0AF0)

TaskWorker: Starting task: [CloudServicesTaskBuilder] SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:49:01 12304 (0x3010)

CloudServicesTaskBuilder: Starting. SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:49:01 5600 (0x15E0)

CloudServicesTaskBuilder: Stopping. SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:49:02 5600 (0x15E0)

TaskManager: 1 task(s) running, 0 task(s) waiting to start. SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:49:02 2800 (0x0AF0)

TaskManager: Task [CloudServicesTaskBuilder] status is RanToCompletion SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:49:02 2800 (0x0AF0)

TaskManager: Removing task [CloudServicesTaskBuilder] from running tasks. SMS_CLOUD_SERVICES_MANAGER 12/12/2023 12:49:02 2800 (0x0AF0)

sms_cloud_proxyconnector.log:

Maintaining connections... SMS_CLOUD_PROXYCONNECTOR 12/12/2023 12:51:37 4524 (0x11AC)

There are 10 WebSocket connections established with proxy server CMG.domainname:443 SMS_CLOUD_PROXYCONNECTOR 12/12/2023 12:51:37 4524 (0x11AC)

Wait 60 seconds to rescan the connections... SMS_CLOUD_PROXYCONNECTOR 12/12/2023 12:51:37 4524 (0x11AC)

ERROR: Failed to build custom cert chain. ChainElementStatus: ElementSubjectName: CN=ISVSCCMMP.fqdn ElementChainStatus: NotSignatureValid ElementSubjectName: CN=SMS Issuing ElementChainStatus: UntrustedRoot SMS_CLOUD_PROXYCONNECTOR 12/12/2023 12:51:39 5700 (0x1644)

ERROR: Failed to build custom cert chain. ChainElementStatus: ElementSubjectName: CN=ISVSCCMMP.fqdn ElementChainStatus: NotSignatureValid ElementSubjectName: CN=SMS Issuing ElementChainStatus: UntrustedRoot SMS_CLOUD_PROXYCONNECTOR 12/12/2023 12:51:40 7152 (0x1BF0)

ERROR: Failed to build custom cert chain. ChainElementStatus: ElementSubjectName: CN=ISVSCCMMP.fqdn ElementChainStatus: NotSignatureValid ElementSubjectName: CN=SMS Issuing ElementChainStatus: UntrustedRoot SMS_CLOUD_PROXYCONNECTOR 12/12/2023 12:51:45 5700 (0x1644)

1 answer

Your answer

Answer 1

XinGuo-MSFT 22,231

Hi,

ERROR: Failed to build custom cert chain. ChainElementStatus: ElementSubjectName: CN=ISVSCCMMP.fqdn ElementChainStatus: NotSignatureValid ElementSubjectName: CN=SMS Issuing ElementChainStatus: UntrustedRoot SMS_CLOUD_PROXYCONNECTOR

Please try to replace the certificate of the CMG server authentication certificate by following the next three steps.

Open the Microsoft Endpoint Configuration Manager administration console and navigate to Administration > Overview > Cloud Services > Cloud Management Gateway

Select {YourCMG} and click Properties in the Home tab to open the {YourCMG} Properties dialog box

In the {YourCMG} Properties dialog box, navigate to the Settings tab, browse to (and select) the new certificate and click OK.

CMG server authentication certificate

https://learn.microsoft.com/en-us/mem/configmgr/core/clients/manage/cmg/server-auth-cert

JG 396 Reputation points

2023-12-13T11:10:25.5766667+00:00

Thanks. I have re-added our existing valid cert for the CMG, but this has not helped. analyser still sees it in a "stopping state"

i did look in the certmgr.log and theres some errors below.

I did notice that the SMS Role SSL certificate on the MP (im using eHTTP) renewed on the 10th Decemeber which was during the first restore (onto clean serverbuild) that failed (due to missing sqlservice account spn)- I did another full restore on 11th (after cleaning the server). Not sure if this ahs any bearing on things.

site exchange certificate is not found. Can not decrypt the data. SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:23 9036 (0x234C)

Failed to decrypt data using format 0. SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:23 9036 (0x234C)

Save SRSRP Encrypted Data - Failed to decrypt user account information (domain\smsssrs) SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:23 9036 (0x234C)

Cancelling network connection to \ISVMEMRP.fqdn\ADMIN$. SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:23 9036 (0x234C)

Cancelling network connection to \ISVMEMRP.fqdn\ADMIN$. SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:23 9036 (0x234C)

Failed to process notification file C:\Program Files\Microsoft Configuration Manager\inboxes\certmgr.box\17_ISVMEMRP.fqdn.CMN (0x87d20807). SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:23 9036 (0x234C)

Found notification file (.CBN) C:\Program Files\Microsoft Configuration Manager\inboxes\certmgr.box\11.CBN SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:23 9036 (0x234C)*

ProcessProviderCertChange() - Process provider cert notification ... SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:23 9036 (0x234C)

ProcessProviderCertChange() - didn't get the serialized certificate, which could be already processed. SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:23 9036 (0x234C)

Entering function CMCertManager::InitializeMPSigningCertificate() SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:23 9036 (0x234C)

InitializeMPCertificate() - Handling signing cert (SysResUseID = 10106) update or insert... SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:24 9036 (0x234C)

Entering function CertManagerUtility::UpsertMDMSigningCertificate() SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:24 9036 (0x234C)

CertManagerUtility::UpsertMDMSigningCertificate - Obtaining the certificate details for 10106 SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:24 9036 (0x234C)

CertManagerUtility::UpsertMDMSigningCertificate - Updating the certificate 1c446c39e3839e022303253e9aa3448b501f6cf2 in database SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:24 9036 (0x234C)

Updated the certificate in the database 10106 SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:24 9036 (0x234C)

InitializeMPCertificate() - Successfully Handled signing cert (SysResUseID = 10106) update or insert. SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:24 9036 (0x234C)

Retrieving any secret key to be encrypted for AAD application SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:24 9036 (0x234C)

EncryptAppSecretKeyForSite() - Encypting secret key for site CLY... SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:24 9036 (0x234C)

EncryptAppSecretKeyForSite() - Retrieving app secret key with ID 16777217 SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:24 9036 (0x234C)

There is no site exchange certificate created. SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:24 9036 (0x234C)

site exchange certificate is not found. Can not decrypt the data. SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:24 9036 (0x234C)

Failed to decrypt data using format 0. SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:24 9036 (0x234C)

EncryptAppSecretKeyForSite() - Failed to decrypt secret key (LastError=0) SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:24 9036 (0x234C)

ProcessCloudManagementAppSecretKeyEncryption() - Failed to encrypt app secret keys for site CLY SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:24 9036 (0x234C)

Entering function CMCertManager::InitializeMPSigningCertificate() SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:24 9036 (0x234C)

InitializeMPCertificate() - Handling signing cert (SysResUseID = 10106) update or insert... SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:24 9036 (0x234C)

Entering function CertManagerUtility::UpsertMDMSigningCertificate() SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:24 9036 (0x234C)

CertManagerUtility::UpsertMDMSigningCertificate - Obtaining the certificate details for 10106 SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:24 9036 (0x234C)

CertManagerUtility::UpsertMDMSigningCertificate - Updating the certificate 1c446c39e3839e022303253e9aa3448b501f6cf2 in database SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:24 9036 (0x234C)

Updated the certificate in the database 10106 SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:24 9036 (0x234C)

InitializeMPCertificate() - Successfully Handled signing cert (SysResUseID = 10106) update or insert. SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:24 9036 (0x234C)

servers will be polled in 1481 seconds... SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:24 9036 (0x234C)

ProcessNotifications found inbox file: 25197831.UDA SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:26 9076 (0x2374)

HSM provider Enabled set to FALSE. SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:26 9076 (0x2374)

Pfx Handler - ProcessPfxUDAChange() for 25197831... SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:26 9076 (0x2374)

RetrievePfxData - WHERE UserItemKey=2063685283 and IsTombstoned=0 SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:26 9076 (0x2374)

ProcessPfxUDAChange SUCCEEDED for 25197831.UDA SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:26 9076 (0x2374)

Detected a change to the "C:\Program Files\Microsoft Configuration Manager\inboxes\certmgr.box" directory. SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:26 9036 (0x234C)

Found notification file C:\Program Files\Microsoft Configuration Manager\inboxes\certmgr.box\17_ISVMEMRP.fqdn.CMN SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:26 9036 (0x234C)

The machine account will be used for ["Display=\ISVMEMRP.fqdn"]MSWNET:["SMS_SITE=CLY"]\ISVMEMRP.fqdn. SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:26 9036 (0x234C)

Successfully made a network connection to \ISVMEMRP.fqdn\ADMIN$. SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:26 9036 (0x234C)

The machine account will be used for ["Display=\ISVMEMRP.fqdn"]MSWNET:["SMS_SITE=CLY"]\ISVMEMRP.fqdn. SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:26 9036 (0x234C)

Successfully made a network connection to \ISVMEMRP.fqdn\ADMIN$. SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:26 9036 (0x234C)

There is no site exchange certificate created. SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:27 9036 (0x234C)

site exchange certificate is not found. Can not decrypt the data. SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:27 9036 (0x234C)

Failed to decrypt data using format 0. SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:27 9036 (0x234C)

Save SRSRP Encrypted Data - Failed to decrypt user account information (domain\smsssrs) SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:27 9036 (0x234C)

Cancelling network connection to \ISVMEMRP.fqdn\ADMIN$. SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:27 9036 (0x234C)

Cancelling network connection to \ISVMEMRP.fqdn\ADMIN$. SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:27 9036 (0x234C)

Failed to process notification file C:\Program Files\Microsoft Configuration Manager\inboxes\certmgr.box\17_ISVMEMRP.fqdn.CMN (0x87d20807). SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:27 9036 (0x234C)

Found notification file (.CBN) C:\Program Files\Microsoft Configuration Manager\inboxes\certmgr.box\11.CBN SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:27 9036 (0x234C)*

ProcessProviderCertChange() - Process provider cert notification ... SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:27 9036 (0x234C)

ProcessProviderCertChange() - didn't get the serialized certificate, which could be already processed. SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:27 9036 (0x234C)

Entering function CMCertManager::InitializeMPSigningCertificate() SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:27 9036 (0x234C)

InitializeMPCertificate() - Handling signing cert (SysResUseID = 10106) update or insert... SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:27 9036 (0x234C)

Entering function CertManagerUtility::UpsertMDMSigningCertificate() SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:27 9036 (0x234C)

CertManagerUtility::UpsertMDMSigningCertificate - Obtaining the certificate details for 10106 SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:27 9036 (0x234C)

CertManagerUtility::UpsertMDMSigningCertificate - Updating the certificate 1c446c39e3839e022303253e9aa3448b501f6cf2 in database SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:27 9036 (0x234C)

Updated the certificate in the database 10106 SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:27 9036 (0x234C)

InitializeMPCertificate() - Successfully Handled signing cert (SysResUseID = 10106) update or insert. SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:27 9036 (0x234C)

Retrieving any secret key to be encrypted for AAD application SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:27 9036 (0x234C)

EncryptAppSecretKeyForSite() - Encypting secret key for site CLY... SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:27 9036 (0x234C)

EncryptAppSecretKeyForSite() - Retrieving app secret key with ID 16777217 SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:27 9036 (0x234C)

There is no site exchange certificate created. SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:27 9036 (0x234C)

site exchange certificate is not found. Can not decrypt the data. SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:27 9036 (0x234C)

Failed to decrypt data using format 0. SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:27 9036 (0x234C)

EncryptAppSecretKeyForSite() - Failed to decrypt secret key (LastError=0) SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:27 9036 (0x234C)

ProcessCloudManagementAppSecretKeyEncryption() - Failed to encrypt app secret keys for site CLY SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:27 9036 (0x234C)

Entering function CMCertManager::InitializeMPSigningCertificate() SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:27 9036 (0x234C)

InitializeMPCertificate() - Handling signing cert (SysResUseID = 10106) update or insert... SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:27 9036 (0x234C)

Entering function CertManagerUtility::UpsertMDMSigningCertificate() SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:27 9036 (0x234C)

CertManagerUtility::UpsertMDMSigningCertificate - Obtaining the certificate details for 10106 SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:27 9036 (0x234C)

CertManagerUtility::UpsertMDMSigningCertificate - Updating the certificate 1c446c39e3839e022303253e9aa3448b501f6cf2 in database SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:27 9036 (0x234C)

Updated the certificate in the database 10106 SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:27 9036 (0x234C)

InitializeMPCertificate() - Successfully Handled signing cert (SysResUseID = 10106) update or insert. SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:27 9036 (0x234C)

servers will be polled in 1478 seconds... SMS_CERTIFICATE_MANAGER 13/12/2023 10:49:27 9036 (0x234C)

In ProcessDeviceCertRevocation SMS_CERTIFICATE_MANAGER 13/12/2023 10:53:04 9080 (0x2378)

There is no default certificate revocation user defined. SCEP certificate revocations will use the site server machine account. SMS_CERTIFICATE_MANAGER 13/12/2023 10:53:04 9080 (0x2378)

There are no more records in CertRevocationNotifyEx table. SMS_CERTIFICATE_MANAGER 13/12/2023 10:53:04 9080 (0x2378)
JG 396 Reputation points

2023-12-13T16:29:32.63+00:00

Have managed to get the CMG in a running state (by renewing the secret keys (as a GA)), but clients are still not connecting to the CMG - still think theres an issue with the certs- not as many clients as expected are sending hinv either

Post to https://CMG/CCM_PROXY_MUTUALAUTH/72057594093XXX2/ccm_system/request failed with 0x87d00231. CcmMessaging 13/12/2023 16:20:46 15264 (0x3BA0)

OutgoingMessage(Queue='mp_mp_ddrendpoint', ID={4F43F2F5-A3F1-4850-AF4D-553385335F5D}): Error posting to host 'CMG/CCM_PROXY_MUTUALAUTH/72057594037938042' (0x87d00231). CcmMessaging 13/12/2023 16:20:46 15264 (0x3BA0)

thanks
XinGuo-MSFT 22,231 Reputation points

2023-12-14T08:23:09.8733333+00:00

Congratulations the CMG is working.

For CMG Client Communication Failure, we could start from the log files.

CMGService.log and SMS_Cloud_ProxyConnector.log

SCCM CMG Log Files for Troubleshooting | Fix CMG Issues
JG 396 Reputation points

2023-12-18T16:48:59.1566667+00:00

Hi, So it appears that about 5 clients have connected through the CMG today. I have 3 test clients- one is connected and 2 are not.

I connected one laptop to the vpn to see if that helped, but its not even showing up as online in the console. (there are lots of machines showing up as online in the console)

I think there;s something maybe certificate wise?

Im using eHTTP

here's a few errors i thought were important from some of the logs ive attachedlogs.txt (zip renamed to txt so i can attach rather than pasting all the logs in the post)

Request to https://cmg.domain.com/CCM_Proxy_ServerAuth/72057594037938042/CCM_STS failed with 401 - Access denied BgbAgent

Failed to get server SSL certificate context. Error 0x80072ee7 BgbAgent

Server 'ISVSCCMMP.fqdn' is not a MP

UpdateURLWithTransportSettings(): OLD URL - http://MP/CCM_Incoming/

UpdateURLWithTransportSettings(): NEW URL - http://MP:80/CCM_Incoming/

any help appreciated thanks
JG 396 Reputation points

2023-12-19T11:19:26.0333333+00:00

Have discovered that the PXE server wasnt working- and have had to recreate the certificate.. which makes me think there's an issue with the certificates for the site after the restore.

I noticed that the PKI certs (for the servers as opposed to the self signed certs (i'm using ehttp)) have an expiration date of 10 Dec 24 (so assuming they were created during the first failed restore on 10th as opposed to the second restore i did that worked (after sql spn registration) on the 11th.

https://msitproblog.com/2019/07/24/repairing-broken-configmgr-pxe-component-after-site-restore/

An error occurred during encode or decode operation. (Error: 80092002; Source: Windows) SMSPXE 19/12/2023 09:58:47 6048 (0x17A0)

Failed to create certificate store from encoded certificate. Verify the provided Certificate was provisioned correctly. .

An error occurred during encode or decode operation. (Error: 80092002; Source: Windows) SMSPXE 19/12/2023 09:58:47 6048 (0x17A0)

PXE::MP_GetList failed; 0x80092002 SMSPXE 19/12/2023 09:58:47 6048 (0x17A0)

PXE::MP_ReportStatus failed; 0x80092002 SMSPXE 19/12/2023 09:58:47 6048 (0x17A0)
XinGuo-MSFT 22,231 Reputation points

2023-12-25T07:03:43.5266667+00:00

As there have been no responses to this post, I suggest initiating a support case with Microsoft Customer Support Services (CSS). They can collaborate with you to address and resolve this issue.

Share via

CMG connection not working after restore

1 answer

Your answer