Management Point with error in mpcontrol and inetpub 403 - Failed to retrieve client certificate

Question

Afternoon all !!!
I have the following issue:
Failed to retrieve client certificate. Error -2147467259 SMS_MP_CONTROL_MANAGER 17/08/2023 17:49:18 5796 (0x16A4)
Call to HttpSendRequestSync failed for port 443 with -2147467259 error code. SMS_MP_CONTROL_MANAGER 17/08/2023 17:49:18 5796 (0x16A4)
Sent summary record of SMS Management Point on ["Display=\XXXX.XXXX.COM"]MSWNET:["SMS_SITE=CAR"]\XXX.XXXX.CARREFOUR.COM\ to C:\SMS\MP\OUTBOXES\sitestat.box\fb5ht01b.SUM, Availability 1, 146076668 KB total disk space , 91179720 KB free disk space, installation state 0. SMS_MP_CONTROL_MANAGER 17/08/2023 17:49:18 5796 (0x16A4)
Http test request failed, error code is -2147467259. SMS_MP_CONTROL_MANAGER 17/08/2023 17:49:18 5796 (0x16A4)

I think is related with PKI certificated but I'm not sure and I want to know if MP need client authenticate certificate and server authenticate certificate. Server authenticate it's normal and obviously but client? It's needed? Why? When MP use it?

Have another question, in IIS logs I saw the errors, but I saw too the 200 code in HTTPS connects, how? Why?
For example:
2023-08-17 12:07:39 1x.7x.7x.x4 CCM_POST /BGB/handler.ashx RequestType=Continue 443 - 1X.7X.7X.XX4 ccmhttp - 403 7 0 1690 15
2023-08-17 12:07:39 1x.7x.7x.x4 GET /SMS_MP_TOKENAUTH/.sms_aut MPKEYINFORMATIONEX 443 - 1X.7X.7X.XX4 SMS+CCM+5.0 - 200 0 0 5301 15
2023-08-17 12:07:39 1x.7x.7x.x4 CCM_POST /BGB/handler.ashx RequestType=Continue 443 - 1X.7X.7X.XX4 ccmhttp - 200 0 0 1402 46
2023-08-17 12:07:39 1x.7x.7x.x4 CCM_POST /BGB/handler.ashx RequestType=Continue 443 - 1X.7X.7X.XX4 ccmhttp - 200 0 0 538 221264
2023-08-17 12:07:39 10.71.75.x4 GET /SMS_MP/.sms_aut MPCERT2 443 - 1X.7X.7X.XX4 SMS+CCM+5.0 - 403 7 0 1589 15
2023-08-17 12:07:39 1x.7x.7x.x4 GET /SMS_MP_TOKENAUTH/.sms_aut MPCERT2 443 - 1X.7X.7X.XX4 SMS+CCM+5.0 - 200 0 0 6133 0
2023-08-17 12:07:40 1x.7x.7x.x4 CCM_POST /BGB/handler.ashx RequestType=Continue 443 - 1X.7X.7X.XX4 ccmhttp - 403 7 0 1690 15

I understand the 200 code is a request to get the token but when try to post we get the error because certified is expired. So... Where in Microsoft documentation is explained why we need client authentication certificate in MP? I don't see nothing about :(

Can someone help me ?

TIA!!!

Answer 1

Solved, renew the certificate client authentication and works fine.

I think it's needed to self-test.

Regards,

Answer 2

I do remember that CM server requires also client cert from PKI. Start from here: https://learn.microsoft.com/en-us/mem/configmgr/core/plan-design/security/certificates-overview

Look into this as well: https://www.prajwaldesai.com/deploy-pki-certificates-for-sccm-2012-r2/

You should first check, what cert is binded in IIS for 443 port.

Answer 3

Hi,

Thanks very much for your feedback and sharing. We're glad that the issue is gone now. It's appreciated that you could click "Accept Answer" to the helpful reply, this will help other users to search for useful information more quickly. Here's a short summary for the problem.

Problem/Symptom:

The error below is generating in mpcontrol.log:

Failed to retrieve client certificate. Error -2147467259

Call to HttpSendRequestSync failed for port 443 with -2147467259 error code.

Solution/Workaround:

Renew the certificate client authentication and works fine.

Thanks again for your time. Have a nice day!

Best regards,

Simon

---

If the response is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.