Our ConfigMgr server was down for 4 days and during that time certs expired. When back online, we updated the certs. Devices started to come back however not all of them
Some are "Active" and others are "Inactive", after doing a lot of checking this is what we have found.
Server Authentication and Client Authentication EKUs.
Bound to IIS HTTPS 443.
AD MP discovery works.
The client has a valid PKI certificate.
ConfigMgr selects the valid certificate.
The client can retrieve ConfigMgr security information from AD.
It can refresh the Trusted Root Key.
MPControl selects it and gets HTTP 200.
The MP's MPCERT endpoint returns that exact same 2BEE certificate.
Your decoded MPCERT data contains the MP FQDN and validity information.
On the affected workstation, the certificate chains successfully to our <domain>-<CertAuthority>.
HasPrivateKey=False on the client copy returned by MPCERT is correct; the private key stays on the MP.
ConfigMgr's own message-verification process on the client
rejects something that ordinary PKI validation proves is good.
Not sure what we need to do to get the other devices to Active, tried triggering Heartbeat and Policy on clients as well
Some are "Active" and others are "Inactive", after doing a lot of checking this is what we have found.
Server Authentication and Client Authentication EKUs.
Bound to IIS HTTPS 443.
AD MP discovery works.
The client has a valid PKI certificate.
ConfigMgr selects the valid certificate.
The client can retrieve ConfigMgr security information from AD.
It can refresh the Trusted Root Key.
MPControl selects it and gets HTTP 200.
The MP's MPCERT endpoint returns that exact same 2BEE certificate.
Your decoded MPCERT data contains the MP FQDN and validity information.
On the affected workstation, the certificate chains successfully to our <domain>-<CertAuthority>.
HasPrivateKey=False on the client copy returned by MPCERT is correct; the private key stays on the MP.
ConfigMgr's own message-verification process on the client
rejects something that ordinary PKI validation proves is good.
Not sure what we need to do to get the other devices to Active, tried triggering Heartbeat and Policy on clients as well
