SOLVED Client show self-signed in console even it use PKI

[Marek Belan]

After update to 2107 all clients start showing in console as self-signed but on client in ClientIDManagerStartup.log they have PKI cert.
I try restart client , computer , server nothing help.
On 2013 all cliens was on PKI.

If client have old 2013 version its show OK, with new version show self-signed.

 

[Prajwal Desai]

If you are using PKI certs, on the primary site properties window, why have you selected HTTP or HTTPS and why not only HTTPS ?.

Simple Guide to Enable SCCM Enhanced HTTP Configuration

In this post I will show you how to enable SCCM enhanced HTTP configuration. We will also discuss what exactly is the enhance HTTP configuration in SCCM, how

www.prajwaldesai.com

Starting with SCCM 2103 you will require to select HTTPS communication or enhanced HTTP configuration. You must plan to configure the site for HTTPS only or to use Configuration Manager-generated certificates for HTTP site systems. If you don’t select between the two you may encounter a warning during the SCCM 2103 update installation.

 

[Marek Belan]

its setup for sure if some server out of domain dont have valid certificate.

 

[Prajwal Desai]

If you are using PKI certs, the site properties settings should look like this.

 

[Marek Belan]

If you are using PKI certs, on the primary site properties window, why have you selected HTTP or HTTPS and why not only HTTPS ?.

Simple Guide to Enable SCCM Enhanced HTTP Configuration

In this post I will show you how to enable SCCM enhanced HTTP configuration. We will also discuss what exactly is the enhance HTTP configuration in SCCM, how

www.prajwaldesai.com

OMFG OK its feature not bug. No one who have 2107 dont see this?

Certificates overview - Configuration Manager

Learn about how Configuration Manager uses self-signed and PKI digital certificates.

docs.microsoft.com

Or noone use PKI ?

 

[Mike Muffin]

OMFG OK its feature not bug. No one who have 2107 dont see this?

Certificates overview - Configuration Manager

Learn about how Configuration Manager uses self-signed and PKI digital certificates.

docs.microsoft.com

Or noone use PKI ?

Hello all,
Same issue.. last night we've updated our infrastrcture to 2107 (from 2103) and now the CLients with the new Client Version 5.00.9058.1018 showing "self-signed" in the console.
But checked direct on the client, it's "PKI".

 

[Prajwal Desai]

Ok, I wasn't aware about this change. I could see the same behavior in my lab as well. So, yes I see the Client certificate property in console shows as Self-signed whereas the client control panel Client certificate property shows PKI.

 

[Mike Muffin]

It seems to be a "Know behavior".

Certificates overview - Configuration Manager

Learn about how Configuration Manager uses self-signed and PKI digital certificates.

docs.microsoft.com

 

[Marek Belan]

But why? Where is point of this change?

 

[Mike Muffin]

But why? Where is point of this change?

What do you mean...?
As descibed above (with the Microsoft Article Link) it's a new behavior in Version 2107.

 

[defrancescoe]

Devices in SCCM Console staying self-signed while its showing PKI on the client side - Microsoft Q&A

Hi all, We initially setup our SCCM environemnt using HTTP but now decided to flip to PKI to support CMG. We only have 1 MP which is on the Primary site as well. I have switched over MP, DP and SUP to use HTTPS, also binded MP 443 port to the IIS cert I…

docs.microsoft.com

 

[Prajwal Desai]

Ok this issue is resolved in the latest version of ConfigMgr, which is 2309. I will confirm this with Microsoft and respond here later.