Part 11: ConfigMgr (SCCM) HTTPS/PKI Configuration

[@TekNexSolutions]

📌 Checkout full playlist here kzbin.info/aero/PLuB-nSPBO_bNRt9FwrocOlZf4prT-Oa3J 📌 This playlist is applicable for new baseline Current Branch version 2103

[@rienusvanhees6214]

I have seen many Videos with CM Issues; these ones are for sure one of the best I found. I have followed doing all stepps in My Lab and it give me many "ahaaaa" moments. No Problems with anything and everything is running as expected :-) Great speaker with great Knowledge and Expert Level of explaining. Thumbs Up and keep on going!

[@yogeshgupta1991]

Awesome Mate...Finally I was able to move to PKI with the help of your tutorial...Thank you

[@TekNexSolutions]

Sounds great. I am glad you find it helpful.

[@discipleofjesus2969]

Addicted to your channel...This man is amazing 🔥🔥🔥

[@dbib9754]

Mate you are fantastic with your explanations and demonstration. Liked and subscribed

[@TekNexSolutions]

Awesome, thank you!

[@MrBankai15]

Finally, I was waiting for your video, thanks man, you're awesome

[@akhaira1490]

I will definitely follow this and configure https. Thank you for your great work like always.

[@LightMoonDragonYing]

Thanks for this informative video, enjoyed watching your video, keep up the great work!

[@TekNexSolutions]

Appreciate your feedback 👍

[@abdelalielghazrani5956]

good good explanation, liked + subscribed

[@balalahmad2652]

i was looking for same from a long time , thanks

[@its_Tricky83]

Thanks. Found this tutorial to be very informative!

[@TekNexSolutions]

I am glad it helped and appreciate the super thanks.

[@Noursbear]

Excellent tutorial, cheers

[@chill2195]

This is alot, I'm definitely going back view this again. 👌

[@skanaga1608]

Amazing Video !! ! thank you

[@sunilpal7933]

Very well explained and implemented lab successfully. When you will make video on CMG.

[@chrisramlow5302]

I too have no Software update point @ Site System Roles. I have done all Parts from 1 to 11. This was going flawlessly up to this point. Hopefully your comment below to klaus about seeing your other video, that appears to be related to your 2019 sccm series and not this series or MEMC - Part 22 - Software Update Point Role Installation and Configuration - where you installed SUP for SCCM - works as a stop gap. Please advise otherwise. Thanks Jai.

[@hodorh4536]

Love your work . Thank you!

[@RanjitSingh-eh8yg]

Love your work

[@1amansahibsingh222]

Very helpful video....

[@hasegawa1011]

Great guide! I had been following another guide and got stuck imaging after enabling PKI because I wasn't sure of how to export and use the root certificate.

[@TekNexSolutions]

Glad it helped!

[@LatironLondon]

Love your SCCM Video series. Have watched over and over, and reference them quite a lot. I have also told colleagues about your videos. So first off, thank you for doing this. Being autistic, watching the videos and learning works for me unlike just reading documentation. I am at 17:30 of the video, but I don't recall you ever creating a CM IIS Servers group in the previous videos. Could you possibly point me to where I missed this step so that I may continue my MECM setup? I would very much appreciate it. And thanks again. Keep doing videos, and I'll keep watching. They help so much!

[@TekNexSolutions]

Thank you for the amazing feedback and sharing videos with your colleagues. I am glad you find these videos helpful. AD Prepaation for the video is covered in this section "Prepare AD for CA" , and here is the direct link to this section kzbin.info/www/bejne/rpO4ZamurKyYetE.

[@LatironLondon]

@@TekNexSolutions Thank you sir for such a fast reply. I don't know how I missed that part. I did the steps right before the IIS Server group, so I must have spaced out when you talked about the II Server group part. Anyhow, TY TY TY!!!!

[@gabrielalicea4803]

This is a great video.

[@Thunderhaha]

Hi, Your tutorial is really very well explained. Thanks for making this Viedeo. Do you have any documentation of the steps for all these installation videos ?

[@TekNexSolutions]

Thank you for the feedback. Adding documentation to blog.masteringmdm.com was the plan. I have updated the documentation in some of the blogs and still trying to add more content to the blogs slowly.

[@kdrummer54]

Very Good tutorial! However, at 36:05 of lesson 11(HTTPS lesson), you reference updating the Software Update Point. I looked back at the previous 10 lessons and cannot find any discussion about setting up a Software Update Point (outside describing what a Software Update Point is early in the tutorial). Can you please let me know where you discuss setting up a Software Update Point in this tutorial or direct me to a location that will help me set one up to a level satisfactory for me to continue with your lessons? Thanks

[@TekNexSolutions]

Check this blog blog.masteringmdm.com/combine-new-and-old-configmgr-youtube-video-series/

[@timgibney5590]

In IIS I got a certificate mismatch when I followed your instructions. update: Disregard I used localhost to test IIS 😀

[@LatironLondon]

How again Jay. In my work environment, they do not use a Windows server for doing certificates. I believe they are using a Linux based server. So, does it matter that the CA is not a Windows Server AD CA? I just want to make sure before we start to proceed. Thanks again, and keep up the awesome work. Would love to see a new MECM Video series using Server 2022, SQL 2019 (Or newer if it's out yet) and MECM 2203. In your spare time of course. ;)

[@TekNexSolutions]

Hi Latiron, Check MS docs and they have listed the prerequisites for certs. You may have to consult with your PKI admin about this. I am pretty green with PKI as I have always used AD CS, and it is a simple and self explanatory setup when you use that.

[@xperi2779]

Hey great series thanks a lot. Im installing WDS role on my sccm server from part 17 of the older serie and im wondering which location it should be installed on? Thanks

[@TekNexSolutions]

You are welcome. Typically, WDS role will need to be installed on your Distribution Point Site System Server. This server will act as PXE server. I may not have mentioned in that video, when you check the box "Enable PXE support for clients" in the Distribution Point properties then system automatically installs WDS role if required. I have time stamped for you, you can check here what I am talking about kzbin.info/www/bejne/jaPVlWyrhrmZbc0. It is the first check box on that time stamp. In the lab, we have DP site system role installed on the same server so this will install WDS role on TEKNEX-CM01 in my case. Let me know if you have any further questions.

[@aareanier9641]

Great guide, followed so far. But at 29:19 "test with fully qualified domain name server.domain.local I receive "DLG_FLAGS_SEC_CERT_CN_INVALID", what i missed. (and probably you need to give quick overview about certificates - why and what)

[@TekNexSolutions]

I have provided with a small intro to the certs which are required, you can check here kzbin.info/www/bejne/rpO4ZamurKyYetE.

[@TekNexSolutions]

Does it work okay for the server name?

[@MrJay3356]

Hi Jay, i followed all the video series but facing an error while getting the MP list on IE in my LAB setup.

[@ncbrady]

For those that like to read it's all documented here www.windows-noob.com/forums/topic/16252-how-can-i-configure-pki-in-a-lab-on-windows-server-2016-part-1/ and here www.windows-noob.com/forums/topic/16300-how-can-i-configure-system-center-configuration-manager-in-https-mode-pki-part-1/

[@unkownuser2320]

I have created SCCM client authentication & SCCM certificate and DP certificate now PXE/Boot media is not working unable to get task sequence

[@mohananaidu4627]

Dp,mp and sup roles are in different servers, so I need to import certs into these 3 severs iis and primary server as well. Dp, mp and sup in untrusted forest, how it works in this scenario

[@kool00008]

Hi, we have 2012 R2 and would like to move / migrate to 1902 or may be 2002. What is the best way to achieve this?

[@klausstegelmann9939]

I have no Configuration Manager Client on PC01, there is no Software update point @ Site System Roles. I have done all Parts from 1 to 11.

[@TekNexSolutions]

Seems like you have missed this part of the video - 00:36 ⏩ Recommendations Here is the direct link to the previous video series which I mentioned kzbin.info/aero/PLuB-nSPBO_bP2sEzbVc7_T34jN6Fy9xtK

[@klausstegelmann9939]

@@TekNexSolutions Thank you so much! Everything works fine, keep it up! Greetings from Germany

[@Ello_o.]

for - Configuration Manager Client setup on PC01 - watch this - kzbin.info/www/bejne/ZnfGdZx9bL-baa8 - Software Update Point setup - kzbin.info/www/bejne/npq7iYaMi7ibm6s

[@silverrodriguezlopez2002]

In my case I have my own server for the wsus, how would the configuration be for this case, should the certificate be imported and as DNS put the FQDN of the wsus server or the primary site?

[@TekNexSolutions]

You need to configure your WSUS as a site system and in terms of the certs only web server cert is required. Where WSUS db will sit?

[@RanjitSingh-eh8yg]

very nice

[@diamondwong6212]

Hi Jay, I’m following your steps but stuck at MP with PKI. I’ve enabled HTTPS and the MP log showed successful Installation. However, I’ve rebooted server and client PC, the MP still shows Critical with 0 bytes, no PKI in PC Configuration Console panel. I don’t see errors in WSUS or WCM logs. Would you please help to advise how to troubleshoot it? Many thanks

[@TekNexSolutions]

How did you go with this?

[@GovindPrakash85]

Hi such a informative tech video . Could you please let me know how to make workgroup machines communicate to sccm . Our environment uses pki https . Could you please create video for that as well pls

[@vinodmahindrakar9709]

Hii, I got an error while pulling the DP and IIS CERT from my DC01. IT is showing "The revocation function was unable to check revocation because the revocation server was offline" error

[@TekNexSolutions]

It should have worked by now if your server was part of the right security group. It happens when the computer object does not have proper permissions on the certificate.

[@dansnewlegs3724]

For some reason my system will not pull down the cert. I've rebooted, done gpupdates and went though the video again. Not sure what I am missing.

[@TekNexSolutions]

Which cert?

[@runargustafson]

@@TekNexSolutions I'm having the same issue on my CM01 server not receiving the CM DP Certificate and the CM IIS Server Certificate (25:41). I have to check Show all templates . Status: Unavailabe. The permissions on the certificate template do not allow current user to enroll for this type of certificate. On the CM-01 server I am logged in as CMAdmin.

[@vinodmahindrakar9709]

@@runargustafson Same error to me

[@bahnjee]

I'm in the same boat. CM server gets the CM Client Cert but neither of the other two (CM DP Cert or CM IIS Servers cert). My CM server is standalone - hosts all roles.

[@bahnjee]

Well, the DP cert was easy enough to fix. I just went to my CM server's certlm.msc and requested it. However, that's not fixing the IIS cert, even after supplying the DNS name in the request (hostname and FQDN) I still get nada. :-s

[@zafarullah9917]

You Cannot request a certificate at this time beacuse no certificate types are available.if yo need certificate please contact your administrator

[@davoodd1638]

Hi, Would please put SCCM download link here? Thanks

[@TekNexSolutions]

Here is the download link for ConfigMgr version 2203 www.microsoft.com/en-us/evalcenter/download-microsoft-endpoint-configuration-manager