SCCM Configure Settings for Client PKI certificates ConfigMgr

SCCM Configure Settings for Client PKI certificates ConfigMgr. Setting up Client PKI certificates is one of the essential steps for HTTPS communication from CMG to MP/SUP.

The Public Key Infrastructure (PKI) is a comprehensive system that includes hardware, software, policies, processes, and procedures for establishing, managing, distributing, utilizing, securing, and revoking digital certificates and public keys.

PKI involves various components such as certificate authorities, registration authorities, certificate repositories, and key recovery systems to ensure the reliable and secure exchange of information

This post will show you how to complete the Client PKI setup tasks for Co-management scenarios. Once you have the Root CA, configuring Client PKI certificates is pretty straightforward.

Sign up to get the best of How To Manage Devices straight to your inbox!

Video Tutorial – Configure Client PKI Certs

PKI is a system for encrypting and signing data. It makes digital certificates to endorse users, devices, or services. The video tutorial given below will show you how to complete the Client PKI setup tasks for Co-management scenarios.

Decision Making – Client PKI

This is a critical decision point for your device management strategy. AAD identity is a better alternative to Client PKI. Even though you have AAD-joined machines, you should have public certs for CMG and CDP. So, you need to decide whether you are going with internal PKI or Public PKI.

Deploying Client PKI Certs to Internet Connected Devices is another important point. Another checkpoint before implementing Client PKI is whether you need to enable Client Check the certificate revocation list (CRL) for site systems or not. I have NOT helped CRL for my lab environment to reduce the overhead.

Co-Management Related Posts

• How To Setup SCCM ConfigMgr Co-Management Video Tutorials
• Overview Windows 10 Co-Management with Intune and SCCM
• Custom Report to Identify Machines Connected via SCCM CMG
• How to Setup Co-Management – Introduction – Prerequisites Part 1
• How to Setup Co-Management – Firewall Ports Proxy Requirements Part 2
• Setup Co-Management – AAD Connect UPN Suffix Part 3
• Setup Co-Management – CA PKI & Certificates Part 4
• Setup Co-Management Cloud DP Azure Blob Storage Part 5
• Setup Co-Management Azure Cloud Services CMG Part 6
• SCCM Configure Settings for Client PKI certificates Part 7 (This Post)
• How to Setup SCCM Co-Management to Offload Workloads to Intune – Part 8
• How to Deploy SCCM Client from Intune – Co-Management – Part 9
• End User Experience of Windows 10 Co-Management – Part 10
• FIX SCCM PKI Client Registration Issue Hotfix
• Fix SCCM Sites That Don’t Have Proper HTTPS Configuration Issue ConfigMgr

Configure Settings for Client PKI certificates

There are two sections in Client Computer communication. One is to get the server-side  (site system Settings) ready for the secured (HTTPS), and the other is to configure client computer settings.   Site System Settings  

Select the client computer communication method (HTTP or HTTPS) for the site systems (MP/SUP) that use IIS. To use HTTPS, the server must have a valid PKI web server certificate (server authentication capability).

Client Computer Settings 

Specify settings for client computers when they communicate with site systems that use IIS. When available, use the PKI client certificate (client authentication capability). Public Cert and AAD authentication are other options, as opposed to using Client PKI certificates (as I mentioned in the above section).

Step-by-Step Process to Configure Client PKI Certs

1. In the SCCM CB console, choose Administration.

2. In the Administration workspace, expand Site Configuration, choose Sites, and then choose the primary site server

3. Right-click on the Primary site server, choose Properties and choose the Client Computer Communication tab.

The client Computer Communication tab is available on a primary site only. If you do not see it, check that you are not connected to a CAS or an SCCM secondary site.

4. Choose the HTTPS or HTTP option when you do not require your existing SCCM clients to use PKI certificates. This will also help to implement client PKI for co-management scenarios.

If you chose HTTPS or HTTP, choose Use client PKI certificate (client authentication capability) when available when you want to use a client PKI certificate for HTTP connections. The client uses this certificate instead of a self-signed certificate to authenticate to site systems. This option is automatically chosen if you choose HTTPS only.

Clients who are detected on the Internet or configured for Internet-only client management always use a client PKI certificate.

5. Choose to Use a PKI client certificate (client authentication capability) when available

6. Choose Modify to configure your chosen client selection method for when more than one valid PKI client certificate is available on a client, and then select OK. I don’t have more than one client PKI certificate; hence I didn’t modify this in my lab environment.

7. Select or Clear the check box for clients to check the Certificate Revocation List (CRL). As mentioned in the above section of this post, I cleared the check box for CRL to reduce the overhead.

8. Choose the SET button under the Trusted Root Certification Authorities section. Nonmandatory step for Co-Management scenario.

9. Browse and Select your Root & Intermediate CA certs from Set Root Certificates windows. I don’t have an intermediate CA cert; hence I uploaded only Root CA.

Specify trusted root certification authority (CA) certificates for clients, choose Set, import the root CA certificate files, and select OK.

When you don’t upload Trusted Root CAs in the Trusted Root CA setting on the Client Computer Communication tab, SCCM trusted check but assumes that Trusted Root certificates are otherwise properly implemented on clients and servers in the environment.

I have not tested this in the latest version of the SCCM CB environment.

10. Choose OK to close the properties dialog box for the site

Bonus Tips about Client PKI Certificates

Following are some of the thought points I have in mind and implemented in my lab environment.

• Intune can deploy Root CA certs to Internet-connected client devices, or if you have domain-joined machines, you can use group policy to deploy Root CA certs.
• Use ARM wherever possible to avoid Azure management certs (otherwise, use self-signed certs)
  Server PKI Cert for MP/SUP – IIS HTTPS communication (Or else we can use SCCM generated cert as you can see in the post)
• Server PKI Cert for CDP/CMG – Client communication
• Root and Intermediate CA certs uploaded to CMG

Reference

• PKI certificate requirements for SCCM
• SCCM Internet-Based Client Management Topology Design

We are on WhatsApp. To get the latest step-by-step guides and news updates, Join our Channel. Click here –HTMD WhatsApp.

Author

Anoop C Nair is Microsoft MVP! He is a Device Management Admin with more than 20 years of experience (calculation done in 2021) in IT. He is a Blogger, Speaker, and Local User Group HTMD Community leader. His primary focus is Device Management technologies like SCCM 2012, Current Branch, and Intune. He writes about ConfigMgr, Windows 11, Windows 10, Azure AD, Microsoft Intune, Windows 365, AVD, etc.