Cannot install the client error 0x80072f8f

Question

Hello,

The CRL was unchecked on Tuesday, May 11 which is two days ago...

For a machine I am getting an error 0x80072f8f which looks like an issue with the certificate but not sure where to get more information...

==========[ ccmsetup started in process 8160 ]==========

Running on platform X64
Launch from folder C:\Windows\ccmsetup\
CcmSetup version: 5.0.9040.1044
Found Microsoft Application Root Cert
Folder 'Microsoft\Microsoft\Configuration Manager' not found. Task does not exist.
Folder 'Microsoft\Microsoft\Configuration Manager' not found. Task does not exist.
In ServiceMain
Folder 'Microsoft\Microsoft\Configuration Manager' not found. Task does not exist.
Folder 'Microsoft\Microsoft\Configuration Manager' not found. Task does not exist.
Updating MDM_ConfigSetting.ClientDeploymentErrorCode with value 0
OS is not Win10RS3+, ENDOK.
[VOPTXDB1] Running on 'Microsoft Windows Server 2008 R2 Enterprise ' (6.1.7601). Service Pack (1.0). SuiteMask = 274. Product Type = 18
Ccmsetup command line: "C:\Windows\ccmsetup\ccmsetup.exe" /runservice /ForceInstall /ignoreskipupgrade /config:MobileClient.tcf
Command line parameters for ccmsetup have been specified. No registry lookup for command line parameters is required.
SslState value: 224
CCMHTTPPORT: 80
CCMHTTPSPORT: 443
CCMHTTPSSTATE: 448
CCMHTTPSCERTNAME:
Lookup MP: VRPSCCMPR01.ad
FSP: VRPSCCMRS01.ad
CCMCERTSTORE: MY
CCMCERTISSUERS: CN=ad-VRCA-CA; DC=ad | CN=XXXX Root Certificate Authority
CCMFIRSTCERT: 1
CCMPKICERTOPTIONS: 1
MANAGEDINSTALLER: 0
Begin searching client certificates based on Certificate Issuers
Certificate Issuer 1 [CN=ad-VRCA-CA; DC=ad]
Certificate Issuer 2 [CN=XXXX AD Certificate Authority]
Analyzing 1 Chain(s) found
Chain has Certificate [Thumbprint 9F7777AE9CF78198698FE243F939826BC6294A01] issued to [] issued by [CN=XXXX AD Certificate Authority-CA1; DC=ad]
Chain has Certificate [Thumbprint 3D4FDAC359EF8DA12CDE84FA6C31237A00021FF7] issued to [CN=XXXX AD Certificate Authority-CA1, DC=ad] issued by [CN=XXXX Root Certificate Authority]
Chain has Certificate [Thumbprint B60BA9406B1B7ADBF4848CE3DA0E977105C2ED92] issued to [CN=XXXX Root Certificate Authority] issued by [CN=XXXX Root Certificate Authority]
Based on Certificate Issuer 'CN=XXXX Root Certificate Authority' found Certificate [Thumbprint 9F7777AE9CF78198698FE243F939826BC6294A01] issued to 'VOPTXDB1.ad'
Begin validation of Certificate [Thumbprint 9F7777AE9CF78198698FE243F939826BC6294A01] issued to 'VOPTXDB1.ad'
CRL check enabled.
Verification of Certificate chain returned 00000000
Completed validation of Certificate [Thumbprint 9F7777AE9CF78198698FE243F939826BC6294A01] issued to 'VOPTXDB1.ad'
Analyzing 1 Chain(s) found
Chain has Certificate [Thumbprint 4E7691BC7D0677D727106F58CFA769DA1EC94FE2] issued to [CN=VOPTXDB1.ad] issued by [CN=XXXX AD Certificate Authority-CA1; DC=ad]
Chain has Certificate [Thumbprint 3D4FDAC359EF8DA12CDE84FA6C31237A00021FF7] issued to [CN=XXXX AD Certificate Authority-CA1, DC=ad] issued by [CN=XXXX Root Certificate Authority]
Chain has Certificate [Thumbprint B60BA9406B1B7ADBF4848CE3DA0E977105C2ED92] issued to [CN=XXXX Root Certificate Authority] issued by [CN=XXXX Root Certificate Authority]
Based on Certificate Issuer 'CN=XXXX Root Certificate Authority' found Certificate [Thumbprint 4E7691BC7D0677D727106F58CFA769DA1EC94FE2] issued to 'VOPTXDB1.ad'
Begin validation of Certificate [Thumbprint 4E7691BC7D0677D727106F58CFA769DA1EC94FE2] issued to 'VOPTXDB1.ad'
CRL check enabled.
Verification of Certificate chain returned 00000000
Completed validation of Certificate [Thumbprint 4E7691BC7D0677D727106F58CFA769DA1EC94FE2] issued to 'VOPTXDB1.ad'
Completed searching client certificates based on Certificate Issuers
Begin to select client certificate
The 'Certificate Selection Criteria' was not specified, counting number of certificates present in 'MY' store of 'Local Computer'.
2 certificate(s) found in the 'MY' certificate store.
The 'MY' of 'Local Computer' store has 2 certificate(s). Using custom selection criteria based on the machine name.
Machine name is 'VOPTXDB1.ad'.
Begin validation of Certificate [Thumbprint 4E7691BC7D0677D727106F58CFA769DA1EC94FE2] issued to 'VOPTXDB1.ad'
Allowing usage of CNG key storage.
The Certificate [Thumbprint 4E7691BC7D0677D727106F58CFA769DA1EC94FE2] issued to 'VOPTXDB1.ad' has 'Client Authentication' capability.
Completed validation of Certificate [Thumbprint 4E7691BC7D0677D727106F58CFA769DA1EC94FE2] issued to 'VOPTXDB1.ad'

>> Client selected the PKI Certificate [Thumbprint 4E7691BC7D0677D727106F58CFA769DA1EC94FE2] issued to 'VOPTXDB1.ad'

Failed to read assigned site code from registry. Error code = 0x80070002
Performing AD query: '(&(ObjectCategory=mSSMSManagementPoint)(mSSMSDefaultMP=TRUE)(mSSMSSiteCode=UCP))'
OperationalXml '<ClientOperationalSettings><Version>5.00.9040.1016</Version><SecurityConfiguration><SecurityModeMask>0</SecurityModeMask><SecurityModeMaskEx>448</SecurityModeMaskEx><HTTPPort>80</HTTPPort><HTTPSPort>443</HTTPSPort><CertificateStoreName></CertificateStoreName><CertificateIssuers>CN=ad-VRCA-CA; DC=ad | CN=XXXX Root Certificate Authority</CertificateIssuers><CertificateSelectionCriteria></CertificateSelectionCriteria><CertificateSelectFirstFlag>1</CertificateSelectFirstFlag><PKICertOptions>1</PKICertOptions><SiteSigningCert>308202FB308201E3A00302010202103D2CFCA6B6FD15A64B1C3CAA9ACFCD7B300D06092A864886F70D0101…6AAAE540A6155DEA6440D5B0416C142D60C035D4D7FEBBFBAAEA65BEDB1BC</SiteSigningCert></SecurityConfiguration><RootSiteCode>UCP</RootSiteCode><CCM> <CommandLine>SMSSITECODE=UCP DNSSUFFIX=ad SMSMP=VRPSCCMPR01.ad CCMHOSTNAME=SCCMinternet.ad FSP=VRPSCCMRS01.ad</CommandLine> </CCM><FSP> <FSPServer>VRPSCCMRS01.ad</FSPServer> </FSP><Capabilities SchemaVersion ="1.0"><Property Name="SSL" Version="1" /><Property Name="SSLState" Value="31" /></Capabilities><Domain Value="ad" /><Forest Value="ad" /><AADConfig Version="1.0"><Tenants></Tenants></AADConfig></ClientOperationalSettings>'
The MP name retrieved is 'VRPSCCMPR01.ad' with version '9040' and capabilities '<Capabilities SchemaVersion="1.0"><Property Name="SSL" Version="1"/><Property Name="SSLState" Value="31"/></Capabilities>'
MP 'VRPSCCMPR01.ad' is compatible
The MP name retrieved is 'VRPSCCMMS03.ad' with version '9040' and capabilities '<Capabilities SchemaVersion="1.0"><Property Name="SSL" Version="1"/><Property Name="SSLState" Value="31"/></Capabilities>'
MP 'VRPSCCMMS03.ad' is compatible
Retrieved 2 MP records from AD for site 'UCP'
Failed to persist AAD on-boarding info. Error 0x87d00227
FromAD: FSP = VRPSCCMRS01.ad
FromAD: command line = SMSSITECODE=UCP DNSSUFFIX=ad SMSMP=VRPSCCMPR01.ad CCMHOSTNAME=SCCMinternet.ad FSP=VRPSCCMRS01.ad
Local Machine is joined to an AD domain
Current AD forest name is ad, domain name is ad
Domain joined client is in Intranet
CMPInfoFromADCache requests are throttled for 00:59:59
Found MP https://VRPSCCMPR01.ad from AD
Found MP https://VRPSCCMMS03.ad from AD
Successfully refresh bootstrap information from AD.
Begin searching client certificates based on Certificate Issuers
Certificate Issuer 1 [CN=ad-VRCA-CA; DC=ad]
Certificate Issuer 2 [CN=XXXX Root Certificate Authority]
Analyzing 1 Chain(s) found
Chain has Certificate [Thumbprint 9F7777AE9CF78198698FE243F939826BC6294A01] issued to [] issued by [CN=XXXX AD Certificate Authority-CA1; DC=ad]
Chain has Certificate [Thumbprint 3D4FDAC359EF8DA12CDE84FA6C31237A00021FF7] issued to [CN=XXXX AD Certificate Authority-CA1, DC=ad] issued by [CN=XXXX Root Certificate Authority]
Chain has Certificate [Thumbprint B60BA9406B1B7ADBF4848CE3DA0E977105C2ED92] issued to [CN=XXXX Root Certificate Authority] issued by [CN=XXXX Root Certificate Authority]
Based on Certificate Issuer 'CN=XXXX Root Certificate Authority' found Certificate [Thumbprint 9F7777AE9CF78198698FE243F939826BC6294A01] issued to 'VOPTXDB1.ad'
Begin validation of Certificate [Thumbprint 9F7777AE9CF78198698FE243F939826BC6294A01] issued to 'VOPTXDB1.ad'
CRL check enabled.
Verification of Certificate chain returned 00000000
Completed validation of Certificate [Thumbprint 9F7777AE9CF78198698FE243F939826BC6294A01] issued to 'VOPTXDB1.ad'
Analyzing 1 Chain(s) found
Chain has Certificate [Thumbprint 4E7691BC7D0677D727106F58CFA769DA1EC94FE2] issued to [CN=VOPTXDB1.ad] issued by [CN=XXXX AD Certificate Authority-CA1; DC=ad]
Chain has Certificate [Thumbprint 3D4FDAC359EF8DA12CDE84FA6C31237A00021FF7] issued to [CN=XXXX AD Certificate Authority-CA1, DC=ad] issued by [CN=XXXX Root Certificate Authority]
Chain has Certificate [Thumbprint B60BA9406B1B7ADBF4848CE3DA0E977105C2ED92] issued to [CN=XXXX Root Certificate Authority] issued by [CN=XXXX Root Certificate Authority]
Based on Certificate Issuer 'CN=XXXX Root Certificate Authority' found Certificate [Thumbprint 4E7691BC7D0677D727106F58CFA769DA1EC94FE2] issued to 'VOPTXDB1.ad'
Begin validation of Certificate [Thumbprint 4E7691BC7D0677D727106F58CFA769DA1EC94FE2] issued to 'VOPTXDB1.ad'
CRL check enabled.
Verification of Certificate chain returned 00000000
Completed validation of Certificate [Thumbprint 4E7691BC7D0677D727106F58CFA769DA1EC94FE2] issued to 'VOPTXDB1.ad'
Completed searching client certificates based on Certificate Issuers
Begin to select client certificate
The 'Certificate Selection Criteria' was not specified, counting number of certificates present in 'MY' store of 'Local Computer'.
2 certificate(s) found in the 'MY' certificate store.
The 'MY' of 'Local Computer' store has 2 certificate(s). Using custom selection criteria based on the machine name.
Machine name is 'VOPTXDB1.ad'.
Begin validation of Certificate [Thumbprint 4E7691BC7D0677D727106F58CFA769DA1EC94FE2] issued to 'VOPTXDB1.ad'
Allowing usage of CNG key storage.
The Certificate [Thumbprint 4E7691BC7D0677D727106F58CFA769DA1EC94FE2] issued to 'VOPTXDB1.ad' has 'Client Authentication' capability.
Completed validation of Certificate [Thumbprint 4E7691BC7D0677D727106F58CFA769DA1EC94FE2] issued to 'VOPTXDB1.ad'

>> Client selected the PKI Certificate [Thumbprint 4E7691BC7D0677D727106F58CFA769DA1EC94FE2] issued to 'VOPTXDB1.ad'

Config file: C:\Windows\ccmsetup\MobileClientUnicode.tcf
Retry time: 10 minute(s)
MSI log file: C:\Windows\ccmsetup\Logs\client.msi.log
MSI properties: CCMCERTISSUERS="CN=ad-VRCA-CA; DC=ad | CN=XXXX Root Certificate Authority" CCMCERTSTORE="MY" CCMFIRSTCERT="1" CCMHOSTNAME="SCCMinternet.ad" CCMHTTPPORT="80" CCMHTTPSPORT="443" CCMHTTPSSTATE="448" CCMPKICERTOPTIONS="1" DNSSUFFIX="ad" FSP="VRPSCCMRS01.ad" INSTALL="ALL" MANAGEDINSTALLER="0" SMSMP="VRPSCCMPR01.ad" SMSSITECODE="UCP" SMSSLP="VRPSCCMPR01.ad" smsmplist="HTTPS://VRPSCCMMS03.ad;HTTPS://VRPSCCMPR01.ad"
Source List:
MPs:
HTTPS://VRPSCCMMS03.ad
HTTPS://VRPSCCMPR01.ad
Device is not in ESP state. Skip setting ConfigMgr to state 1
No version of the client is currently detected.
Task 'Configuration Manager Client Retry Task' does not exist
Updated security on object C:\Windows\ccmsetup.
Sending state '100'...
Updating MDM_ConfigSetting.ClientDeploymentErrorCode with value 0
OS is not Win10RS3+, ENDOK.
Failed to get client version for sending state messages. Error 0x8004100e
[] Params to send '5.0.9040.1044 Deployment Error: 0x0, '
Sending Fallback Status Point message to 'VRPSCCMRS01.ad', STATEID='100'.
<ClientDeploymentMessage ErrorCode="0"><Client Baseline="1" BaselineCookie="" Platform="2" Langs=""/></ClientDeploymentMessage>
State message with TopicType 800 and TopicId {E09E4F77-385B-4F6D-9A4A-297531537125} has been sent to the FSP
Detected 29811 MB free disk space on system drive.
Client OS Version 6.1 Service Pack 1.0
Running as user "SYSTEM"
Checking Write Filter Status.
This is not a supported write filter device. We are not in a write filter maintenance mode.
SiteCode: UCP
SiteVersion: 5.00.9040.1016
Searching for a valid online MP...
Checking the URL 'HTTPS://VRPSCCMPR01.ad/CCM_Client/ccmsetup.cab'
IsSslClientAuthEnabled - Determining provisioning mode state failed with 80070002. Defaulting to state of 448.
Client is on internet
Client is set to use webproxy if available.
IsSslClientAuthEnabled - Determining provisioning mode state failed with 80070002. Defaulting to state of 448.
Begin searching client certificates based on Certificate Issuers
Certificate Issuer 1 [CN=ad-VRCA-CA; DC=ad]
Certificate Issuer 2 [CN=XXXX Root Certificate Authority]
Analyzing 1 Chain(s) found
Chain has Certificate [Thumbprint 9F7777AE9CF78198698FE243F939826BC6294A01] issued to [] issued by [CN=XXXX AD Certificate Authority-CA1; DC=ad]
Chain has Certificate [Thumbprint 3D4FDAC359EF8DA12CDE84FA6C31237A00021FF7] issued to [CN=XXXX AD Certificate Authority-CA1, DC=ad] issued by [CN=XXXX Root Certificate Authority]
Chain has Certificate [Thumbprint B60BA9406B1B7ADBF4848CE3DA0E977105C2ED92] issued to [CN=XXXX Root Certificate Authority] issued by [CN=XXXX Root Certificate Authority]
Based on Certificate Issuer 'CN=XXXX Root Certificate Authority' found Certificate [Thumbprint 9F7777AE9CF78198698FE243F939826BC6294A01] issued to 'VOPTXDB1.ad'
Begin validation of Certificate [Thumbprint 9F7777AE9CF78198698FE243F939826BC6294A01] issued to 'VOPTXDB1.ad'
CRL check enabled.
Verification of Certificate chain returned 00000000
Completed validation of Certificate [Thumbprint 9F7777AE9CF78198698FE243F939826BC6294A01] issued to 'VOPTXDB1.ad'
Analyzing 1 Chain(s) found
Chain has Certificate [Thumbprint 4E7691BC7D0677D727106F58CFA769DA1EC94FE2] issued to [CN=VOPTXDB1.ad] issued by [CN=XXXX AD Certificate Authority-CA1; DC=ad]
Chain has Certificate [Thumbprint 3D4FDAC359EF8DA12CDE84FA6C31237A00021FF7] issued to [CN=XXXX AD Certificate Authority-CA1, DC=ad] issued by [CN=XXXX Root Certificate Authority]
Chain has Certificate [Thumbprint B60BA9406B1B7ADBF4848CE3DA0E977105C2ED92] issued to [CN=XXXX Root Certificate Authority] issued by [CN=XXXX Root Certificate Authority]
Based on Certificate Issuer 'CN=XXXX Root Certificate Authority' found Certificate [Thumbprint 4E7691BC7D0677D727106F58CFA769DA1EC94FE2] issued to 'VOPTXDB1.ad'
Begin validation of Certificate [Thumbprint 4E7691BC7D0677D727106F58CFA769DA1EC94FE2] issued to 'VOPTXDB1.ad'
CRL check enabled.
Verification of Certificate chain returned 00000000
Completed validation of Certificate [Thumbprint 4E7691BC7D0677D727106F58CFA769DA1EC94FE2] issued to 'VOPTXDB1.ad'
Completed searching client certificates based on Certificate Issuers
Begin to select client certificate
The 'Certificate Selection Criteria' was not specified, counting number of certificates present in 'MY' store of 'Local Computer'.
2 certificate(s) found in the 'MY' certificate store.
The 'MY' of 'Local Computer' store has 2 certificate(s). Using custom selection criteria based on the machine name.
Machine name is 'VOPTXDB1.ad'.
Begin validation of Certificate [Thumbprint 4E7691BC7D0677D727106F58CFA769DA1EC94FE2] issued to 'VOPTXDB1.ad'
Allowing usage of CNG key storage.
The Certificate [Thumbprint 4E7691BC7D0677D727106F58CFA769DA1EC94FE2] issued to 'VOPTXDB1.ad' has 'Client Authentication' capability.
Completed validation of Certificate [Thumbprint 4E7691BC7D0677D727106F58CFA769DA1EC94FE2] issued to 'VOPTXDB1.ad'

>> Client selected the PKI Certificate [Thumbprint 4E7691BC7D0677D727106F58CFA769DA1EC94FE2] issued to 'VOPTXDB1.ad'

ccmsetup: Host=VRPSCCMPR01.ad, Path=/CCM_Client, Port=443, Protocol=https, CcmTokenAuth=0, Flags=0x4300, Options=0x1c0
Created connection on port 443
Trying without proxy.
[CCMHTTP] AsyncCallback(): -----------------------------------------------------------------
[CCMHTTP] AsyncCallback(): WINHTTP_CALLBACK_STATUS_SECURE_FAILURE Encountered
[CCMHTTP] : dwStatusInformationLength is 4
[CCMHTTP] : *lpvStatusInformation is 0x80000000
[CCMHTTP] : WINHTTP_CALLBACK_STATUS_FLAG_SECURITY_CHANNEL_ERROR is set
[CCMHTTP] AsyncCallback(): -----------------------------------------------------------------
Failed in WinHttpSendRequest API, ErrorCode = 0x2f8f
[CCMHTTP] ERROR: URL=HTTPS://VRPSCCMPR01.ad/CCM_Client, Port=443, Options=448, Code=12175, Text=ERROR_WINHTTP_SECURE_FAILURE
[CCMHTTP] ERROR INFO: StatusCode=<unknown> StatusText=
GetDirectoryList failed with a non-recoverable failure, 0x80072f8f
Failed to get directory list from 'HTTPS://VRPSCCMPR01.ad/CCM_Client'. Error 0x80072f8f
Failed to correctly receive a WEBDAV HTTPS request.. (StatusCode at WinHttpQueryHeaders: 0) and StatusText: ''
Failed to check url HTTPS://VRPSCCMPR01.ad/CCM_Client/ccmsetup.cab. Error 0x80004005
Accessing the URL 'HTTPS://VRPSCCMPR01.ad/CCM_Client/ccmsetup.cab' failed with 80004005
Checking the URL 'HTTPS://VRPSCCMMS03.ad/CCM_Client/ccmsetup.cab'
IsSslClientAuthEnabled - Determining provisioning mode state failed with 80070002. Defaulting to state of 448.
Client is on internet
Client is set to use webproxy if available.
IsSslClientAuthEnabled - Determining provisioning mode state failed with 80070002. Defaulting to state of 448.
Using the certificate [Thumbprint 4E7691BC7D0677D727106F58CFA769DA1EC94FE2] issued to 'VOPTXDB1.ad'.
ccmsetup: Host=VRPSCCMMS03.ad, Path=/CCM_Client, Port=443, Protocol=https, CcmTokenAuth=0, Flags=0x4300, Options=0x1c0
Created connection on port 443
Trying without proxy.
[CCMHTTP] AsyncCallback(): -----------------------------------------------------------------
[CCMHTTP] AsyncCallback(): WINHTTP_CALLBACK_STATUS_SECURE_FAILURE Encountered
[CCMHTTP] : dwStatusInformationLength is 4
[CCMHTTP] : *lpvStatusInformation is 0x80000000
[CCMHTTP] : WINHTTP_CALLBACK_STATUS_FLAG_SECURITY_CHANNEL_ERROR is set
[CCMHTTP] AsyncCallback(): -----------------------------------------------------------------
Failed in WinHttpSendRequest API, ErrorCode = 0x2f8f
[CCMHTTP] ERROR: URL=HTTPS://VRPSCCMMS03.ad/CCM_Client, Port=443, Options=448, Code=12175, Text=ERROR_WINHTTP_SECURE_FAILURE
[CCMHTTP] ERROR INFO: StatusCode=<unknown> StatusText=
GetDirectoryList failed with a non-recoverable failure, 0x80072f8f
Failed to get directory list from 'HTTPS://VRPSCCMMS03.ad/CCM_Client'. Error 0x80072f8f
Failed to correctly receive a WEBDAV HTTPS request.. (StatusCode at WinHttpQueryHeaders: 0) and StatusText: ''
Failed to check url HTTPS://VRPSCCMMS03.ad/CCM_Client/ccmsetup.cab. Error 0x80004005
Accessing the URL 'HTTPS://VRPSCCMMS03.ad/CCM_Client/ccmsetup.cab' failed with 80004005
Next retry in 10 minute(s)...

Blockquote

Where should I look, I try to reimport the certificate and it looks good ...

Thanks,
Dom

Answer 1

@Dominique DUCHEMIN

Thank you for posting in Microsoft Q&A forum.

To avoid any misunderstanding, would you mind helping to double confirm the certificates are met the following requirement: In the Enhanced key usage, it should contain Client Authentication.
For more details about the requirments: please refer to the client authentication section in this link: https://learn.microsoft.com/en-us/mem/configmgr/core/plan-design/network/pki-certificate-requirements

Then, we can check the locationservices.log and clientlocation.log on the client side to located the management point through records of the client activity. And view CcmNotificationAgent.log & CCMMessaging.log to check if there's any error of MP communication.

Thanks for your time.

---

If the response is helpful, please click "Accept Answer"and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.