SCCM_CMG - Client Authentication not working from PKI Cert

Question

**

Configurations:

**
SCCM CB v1910
Standalone Primary Site
One CMG Setup configuration completed and connection analyzer show everything OK.
On the Communication settings of the Primary Site, HTTP or HTTPS mode is selected as shown below.
Trusted Root Certification Authorities : The domain Root Cert is expired and it cannot be renewed so we have used Third Party PKI Root Cert which is present on the cert store of the test machines under the folder Trusted Root Certification Authorities. There is no intermediate cert for this Root Cert.

PS Communication Settings

**

Issue description:

**
While testing the HTTPSReadiness on our test machines, the HTTPSReadiness.log shows this:

CMHttpsReadiness.log

It seems that the provided Third Party PKI Trusted Root Cert is parsed but it is not identified or picked by SCCM algorithm.
Similar log is written in ClientIDStartupManager.log.

Does anyone know why this cert is not picked by SCCM for authenticating client for HTTPS Readiness ?

Answer 1

Hi,

Thank you for the detailed description and the screenshots. For the CMG certificate, we may have something to check, for example, the purpose should contains server authentication, the service name, the deployment name, etc.

For the requirement, we may read through this article.
https://learn.microsoft.com/en-in/mem/configmgr/core/clients/manage/cmg/server-auth-cert

Here's also a nice video from former Sr PFE at Microsoft and we can follow this to check every single step to check if we miss anything.

https://setupconfigmgr.com/how-to-setup-cloud-management-gateway-cmg-in-microsoft-sccm
Note: this is just for your reference.

Hope the above information helps.

Alex
If the response is helpful, please click "Accept Answer" and upvote it.