SCCM agent installation get failed on Internet based Co-Managed devices

Question

Hi All,

I am getting below error message on internet-based client when deploy SCCM agent via Intune.

I am using on-prem certificate server (self-sign) for CMG server certificate and I don't have any certificate installed on Client devices since Enhances HTTPS enabled, but since I use on-prem certificate, I have uploaded the Root-CA as a trusted authority provider in client machine. Further, Root-CA is uploaded to the SCCM server as well. I don't see any errors for CMG in content analyzer as well.

I have checked SCCM agent distribution in CMG and it has successfully distributed to the cloud management gateway.

CRL check is disabled on site systems (Clients check the certificate revocation list (CRL) for site systems).

Please note that I didn't configure any boundary configurations, Do I need any boundary configuration settings?

appreciate the help.

Please find attached ccmsetup.log here.

202612-ccmsetup-error.log

dsregcmd status

202721-dsregcmdstatus.txt

thanks,
Dilan

Answer 1

Hi @Dilan Nanayakkara ，

When we use CMG in configuration manager, the server requires a server authentication certificate to build the secure channel. We can acquire a certificate for this purpose from a public provider, or issue it from your public key infrastructure (PKI).

But we can not use on-prem certificate server (self-sign) for CMG server certificate, please change it.
Here is the related article we could refer to:
https://learn.microsoft.com/en-us/mem/configmgr/core/clients/manage/cmg/server-auth-cert

According to the record: Client does not allow to use PKI issued cert and is not AAD capable. Ignoring this MP.

Please check the status client's AAD. If there is something wrong, please retire the client and re-join the AAD.

---

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Hi Dilan

Did you find a solution?

I'm deploying a CMG in my LAB and have the exact same error in ccmsetup.log

Device is AADJ (not hybrid), client deployed using the co-mgmt setting in Intune, Root-CA added to the client.

CMG Connection Analyzer passes with Azure ID and client cert.