PENDING Client doesn't have PKI issued cert and cannot get CCM access token. Error 0x8000ffff after IIS certificate change

[ArnaudT]

Hi,

I recently had my IIS certificate expire which caused all SCCM clients to lose connexion to SCCM.
I had to recreate one because I couldn't renew it since it was expired.
After, creating one and linking it to IIS it worked temporarly in appearance and all clients appeared "green" in SCCM.
But since today im getting a "Client doesn't have PKI issued cert and cannot get CCM access token. Error 0x8000ffff" (CcmMessagin.log)
When I check the lines before this error the certificate i just created is mentionned. Nothing as change appart from this certificate.
Any clue as to what is wrong ?

Begin validation of Certificate [Thumbprint 599C6C6A6924EF8B68C68B0BC8D7C8FF922FE8FF] issued to 'sccm'    CcmMessaging    19/09/2024 17:24:29    15792 (0x3DB0)
Completed validation of Certificate [Thumbprint 599C6C6A6924EF8B68C68B0BC8D7C8FF922FE8FF] issued to 'sccm'    CcmMessaging    19/09/2024 17:24:29    15792 (0x3DB0)
Raising event:
instance of CCM_CcmHttp_Status
{
    ClientID = "GUID:2E2EF079-06BE-43AF-9A04-757FB25F41D4";
    DateTime = "20240919152429.598000+000";
    HostName = "sccm";
    HRESULT = "0x00000000";
    ProcessID = 15568;
    StatusCode = 0;
    ThreadID = 15792;
};
    CcmMessaging    19/09/2024 17:24:29    15792 (0x3DB0)
Begin validation of Certificate [Thumbprint 599C6C6A6924EF8B68C68B0BC8D7C8FF922FE8FF] issued to 'sccm'    CcmMessaging    19/09/2024 17:24:48    15792 (0x3DB0)
Completed validation of Certificate [Thumbprint 599C6C6A6924EF8B68C68B0BC8D7C8FF922FE8FF] issued to 'sccm'    CcmMessaging    19/09/2024 17:24:48    15792 (0x3DB0)
Raising event:
instance of CCM_CcmHttp_Status
{
    ClientID = "GUID:2E2EF079-06BE-43AF-9A04-757FB25F41D4";
    DateTime = "20240919152449.777000+000";
    HostName = "sccm";
    HRESULT = "0x00000000";
    ProcessID = 15568;
    StatusCode = 0;
    ThreadID = 15792;
};
    CcmMessaging    19/09/2024 17:24:49    15792 (0x3DB0)
Begin validation of Certificate [Thumbprint 599C6C6A6924EF8B68C68B0BC8D7C8FF922FE8FF] issued to 'sccm'    CcmMessaging    19/09/2024 17:25:17    15792 (0x3DB0)
Completed validation of Certificate [Thumbprint 599C6C6A6924EF8B68C68B0BC8D7C8FF922FE8FF] issued to 'sccm'    CcmMessaging    19/09/2024 17:25:17    15792 (0x3DB0)
Raising event:
instance of CCM_CcmHttp_Status
{
    ClientID = "GUID:2E2EF079-06BE-43AF-9A04-757FB25F41D4";
    DateTime = "20240919152517.072000+000";
    HostName = "sccm";
    HRESULT = "0x00000000";
    ProcessID = 15568;
    StatusCode = 0;
    ThreadID = 15792;
};
    CcmMessaging    19/09/2024 17:25:17    15792 (0x3DB0)
Begin validation of Certificate [Thumbprint 599C6C6A6924EF8B68C68B0BC8D7C8FF922FE8FF] issued to 'sccm'    CcmMessaging    19/09/2024 17:25:17    15792 (0x3DB0)
Completed validation of Certificate [Thumbprint 599C6C6A6924EF8B68C68B0BC8D7C8FF922FE8FF] issued to 'sccm'    CcmMessaging    19/09/2024 17:25:17    15792 (0x3DB0)
Raising event:
instance of CCM_CcmHttp_Status
{
    ClientID = "GUID:2E2EF079-06BE-43AF-9A04-757FB25F41D4";
    DateTime = "20240919152517.345000+000";
    HostName = "sccm";
    HRESULT = "0x00000000";
    ProcessID = 15568;
    StatusCode = 0;
    ThreadID = 15792;
};
    CcmMessaging    19/09/2024 17:25:17    15792 (0x3DB0)
Begin validation of Certificate [Thumbprint 599C6C6A6924EF8B68C68B0BC8D7C8FF922FE8FF] issued to 'sccm'    CcmMessaging    19/09/2024 17:25:17    15792 (0x3DB0)
Completed validation of Certificate [Thumbprint 599C6C6A6924EF8B68C68B0BC8D7C8FF922FE8FF] issued to 'sccm'    CcmMessaging    19/09/2024 17:25:17    15792 (0x3DB0)
Raising event:
instance of CCM_CcmHttp_Status
{
    ClientID = "GUID:2E2EF079-06BE-43AF-9A04-757FB25F41D4";
    DateTime = "20240919152517.636000+000";
    HostName = "sccm";
    HRESULT = "0x00000000";
    ProcessID = 15568;
    StatusCode = 0;
    ThreadID = 15792;
};
    CcmMessaging    19/09/2024 17:25:17    15792 (0x3DB0)
Begin validation of Certificate [Thumbprint 599C6C6A6924EF8B68C68B0BC8D7C8FF922FE8FF] issued to 'sccm'    CcmMessaging    19/09/2024 17:25:17    15792 (0x3DB0)
Completed validation of Certificate [Thumbprint 599C6C6A6924EF8B68C68B0BC8D7C8FF922FE8FF] issued to 'sccm'    CcmMessaging    19/09/2024 17:25:17    15792 (0x3DB0)
Raising event:
instance of CCM_CcmHttp_Status
{
    ClientID = "GUID:2E2EF079-06BE-43AF-9A04-757FB25F41D4";
    DateTime = "20240919152517.936000+000";
    HostName = "sccm";
    HRESULT = "0x00000000";
    ProcessID = 15568;
    StatusCode = 0;
    ThreadID = 15792;
};
    CcmMessaging    19/09/2024 17:25:17    15792 (0x3DB0)
Begin validation of Certificate [Thumbprint 599C6C6A6924EF8B68C68B0BC8D7C8FF922FE8FF] issued to 'sccm'    CcmMessaging    19/09/2024 17:25:18    16340 (0x3FD4)
Completed validation of Certificate [Thumbprint 599C6C6A6924EF8B68C68B0BC8D7C8FF922FE8FF] issued to 'sccm'    CcmMessaging    19/09/2024 17:25:18    16340 (0x3FD4)
Raising event:
instance of CCM_CcmHttp_Status
{
    ClientID = "GUID:2E2EF079-06BE-43AF-9A04-757FB25F41D4";
    DateTime = "20240919152518.222000+000";
    HostName = "sccm";
    HRESULT = "0x00000000";
    ProcessID = 15568;
    StatusCode = 0;
    ThreadID = 16340;
};
    CcmMessaging    19/09/2024 17:25:18    16340 (0x3FD4)
OutgoingMessage(Queue='mp_[http]mp_locationmanager', ID={5CDA0F5F-6C7C-4E26-AB04-FAFAD397F5AB}): Delivered successfully to host 'sccm'.    CcmMessaging    19/09/2024 17:25:18    16340 (0x3FD4)
Begin validation of Certificate [Thumbprint 599C6C6A6924EF8B68C68B0BC8D7C8FF922FE8FF] issued to 'sccm'    CcmMessaging    19/09/2024 17:25:18    16336 (0x3FD0)
Completed validation of Certificate [Thumbprint 599C6C6A6924EF8B68C68B0BC8D7C8FF922FE8FF] issued to 'sccm'    CcmMessaging    19/09/2024 17:25:18    16336 (0x3FD0)
Raising event:
instance of CCM_CcmHttp_Status
{
    ClientID = "GUID:2E2EF079-06BE-43AF-9A04-757FB25F41D4";
    DateTime = "20240919152518.462000+000";
    HostName = "sccm";
    HRESULT = "0x00000000";
    ProcessID = 15568;
    StatusCode = 0;
    ThreadID = 16336;
};
    CcmMessaging    19/09/2024 17:25:18    16336 (0x3FD0)
OutgoingMessage(Queue='mp_[http]mp_locationmanager', ID={88B043C1-54FF-40BF-AA30-9EAC3E954645}): Delivered successfully to host 'sccm'.    CcmMessaging    19/09/2024 17:25:18    16336 (0x3FD0)
Supplied sender token is null. Using GetUserTokenFromSid to find sender's token.    CcmMessaging    19/09/2024 17:25:29    15788 (0x3DAC)
AAD Auth is not ready for user 'S-1-5-21-2756910171-1525229973-15506425-1103'    CcmMessaging    19/09/2024 17:25:29    15788 (0x3DAC)
Client doesn't have PKI issued cert and cannot get CCM access token. Error 0x8000ffff    CcmMessaging    19/09/2024 17:25:29    15788 (0x3DAC)
[CCMHTTP] ERROR: URL=https://sccm/ccm_system_windowsauth/request, Port=443, Options=1472, Code=0, Text=CCM_E_NO_TOKEN_AUTH    CcmMessaging    19/09/2024 17:25:29    15788 (0x3DAC)
[CCMHTTP] ERROR INFO: StatusCode=403 StatusText=Forbidden    CcmMessaging    19/09/2024 17:25:29    15788 (0x3DAC)

 

[Harshit Pandey]

See this - https://forums.prajwaldesai.com/thr...r-switching-to-https-only-communication.5521/

 

[ArnaudT]

See this - https://forums.prajwaldesai.com/thr...r-switching-to-https-only-communication.5521/

from my understanding of this one, he had a separate CA that was not declared in SCCM, those settings didn't change on my side and it was working fine before.
The only things that changed (at least from my intervention) is the IIS certificate.
The CA is already declared in the settings

 

[ArnaudT]

and what is weird is that it finds the certificate issued by CA to PC but it doesnt work
does this line mean anything ?
ccmsetup: Host=sccm, Path=/ccm_system/request, Port=443, Protocol=https, CcmTokenAuth=0, Flags=0x44300, Options=0x3f

 

[ArnaudT]

I get the same thing while trying to reinstall

Both AAD token auth and client PreAuth are not ready. Cannot get CCM token    ccmsetup    20/09/2024 17:06:42    22404 (0x5784)
Client doesn't have PKI issued cert and cannot get CCM access token. Error 0x8000ffff    ccmsetup    20/09/2024 17:06:42    22404 (0x5784)
[CCMHTTP] ERROR: URL=https://sccm/ccm_system/request, Port=443, Options=63, Code=0, Text=CCM_E_NO_TOKEN_AUTH    ccmsetup    20/09/2024 17:06:42    22404 (0x5784)
[CCMHTTP] ERROR INFO: StatusCode=403 StatusText=Forbidden    ccmsetup    20/09/2024 17:06:42    22404 (0x5784)
Failed (0x87d00455) to send location request to 'sccm'. StatusCode 403, StatusText 'Forbidden'    ccmsetup    20/09/2024 17:06:42    22404 (0x5784)
Failed to send location message to 'https://sccm'. Status text 'Forbidden'    ccmsetup    20/09/2024 17:06:42    22404 (0x5784)
GetDPLocations failed with error 0x87d00455    ccmsetup    20/09/2024 17:06:42    22404 (0x5784)
Failed to get DP locations as the expected version from MP 'https://sccm'. Error 0x87d00455    ccmsetup    20/09/2024 17:06:42    22404 (0x5784)
Sending state '101'...    ccmsetup    20/09/2024 17:06:42    22404 (0x5784)
Updating MDM_ConfigSetting.ClientDeploymentErrorCode with value 0    ccmsetup    20/09/2024 17:06:42    22404 (0x5784)
Failed to get client version for sending state messages. Error 0x8004100e    ccmsetup    20/09/2024 17:06:42    22404 (0x5784)
[] Params to send '5.0.9128.1007 Deployment Error: 0x0, '    ccmsetup    20/09/2024 17:06:42    22404 (0x5784)
A Fallback Status Point has not been specified and no client was installed.  Message with STATEID='101' will not be sent.    ccmsetup    20/09/2024 17:06:42    22404 (0x5784)
Failed to send status 101. Error (87D00215)    ccmsetup    20/09/2024 17:06:42    22404 (0x5784)
Next retry in 10 minute(s)...    ccmsetup    20/09/2024 17:06:42    22404 (0x5784)