Certificate Assistant Generates it's own private key each time

Here's the problem:
1 create a certificate authority... ok.
2.generate a certificate request from that certificate authority... ok... (DONE ON ANOTHER MAC like my laptop...)
3.Send the certificate request to the certificate authority email ok...
4. Receive the certificate request ok... (received on the main desktop machine)
5. Double click on the certificate request... ok it launches the certificate assistant.... and it generates a certificate and mails it back to the other account.
All appears fine.....
EXCEPT that the certificate when imported does not work.... WHY?
WELL
Because a new private key was generated and used instead of simply signing the request....
If of course you send the new public key and the certificate back to the laptop all is well...
But this is NOT how it is supposed to work.
if you get a certificate request you're not supposed to generate a new key pair at the Certificate authority!!! you're just supposed to sign the request
generate the certificate with the given public key and be done with it... but no!!! osx lion insists on generating a new key pair it's self first!!!!
Any help here?
Steve

Isn’t that special? I thought so… drove me crazy until i found a workaround. When the CA generates signed certificate from the CSR, they need to be mindful of whether their Certificate Assistant generates these spurious keys. If it does:
Delete the spurious user keys and user certificate from the CA’s default (usually: login) keychain. Note that in some cases there will not be a user certificate, if Certificate Assistant presented the duplicate certificate in keychain error. Be sure to check carefully!
If Certificate Assistant made it far enough to create the outgoing email message with the defective certificate, delete this message draft.
Re-run the CSR your user sent in, as if you were doing so for the first time.
In my testing, this workaround works 100% of the time: the second time the CSR runs on the CA’s system, the CA’s Certificate Assistant properly signs the user’s certificate and does not make any spurious keys on the CA’s system.
BTW i have seen this happen with Certificate Assistant 2.0/10.5.8 Leopard, CA 3.0/10.6.8 Snow Leopard, and CA 4.4/10.7.5 Lion. I have not yet seen it with CA 5.0/10.8.3 Mountain Lion, though given the intermittent nature of this bug, my confidence is low that it is truly fixed.
I’ve spent the last few years spending waaaaaaay too much time testing and documenting Apple’s OS X and Mail S/MIME implementation, and recently put up web pages with my findings, including this workaround. Hopefully the information will help some folks.
))Sonic((

Similar Messages

My iPad will not auto-connect to my network. I need to type in a security key each time. Is there a way aound this?

my iPad will not auto-connect to my network. I need to type in a security key each time. Is there a way aound this?
Thanks

Some things to try first:
1. Turn Off your iPad. Then turn Off (disconnect power cord for 30 seconds or longer) the wireless router & then back On. Now boot your iPad. Hopefully it will see the WiFi.
2. Go to Settings>Wi-Fi and turn Off. Then while at Settings>Wi-Fi, turn back On and chose a Network.
3. Change the channel on your wireless router (Auto or Channel 6 is best). Instructions at http://macintoshhowto.com/advanced/how-to-get-a-good-range-on-your-wireless-netw ork.html
4. Go into your router security settings and change from WEP to WPA with AES.
5. Renew IP Address: (especially if you are droping internet connection)
    •    Launch Settings app
    •    Tap on Wi-Fi
    •    Tap on the blue arrow of the Wi-Fi network that you connect to from the list
    •    In the window that opens, tap on the Renew Lease button
~~~~~~~~~~~~~~~~~~~~~~~~~
iOS 6 Wifi Problems/Fixes
How To: Workaround iPad Wi-Fi Issues
http://www.theipadfan.com/workaround-ipad-wifi-issues/
Another Fix For iOS 6 WiFi Problems
http://tabletcrunch.com/2012/10/27/fix-ios-6-wifi-problems-ssid/
Wifi Doesn't Connect After Waking From Sleep - Sometimes increasing screen brightness prevents the failure to reconnect after waking from sleep. According to Apple, “If brightness is at lowest level, increase it by moving the slider to the right and set auto brightness to off.”
Fix For iOS 6 WiFi Problems?
http://tabletcrunch.com/2012/09/27/fix-ios-6-wifi-problems/
Did iOS 6 Screw Your Wi-Fi? Here’s How to Fix It
http://gizmodo.com/5944761/does-ios-6-have-a-wi+fi-bug
How To Fix Wi-Fi Connectivity Issue After Upgrading To iOS 6
http://www.iphonehacks.com/2012/09/fix-wi-fi-connectivity-issue-after-upgrading- to-ios-6.html
iOS 6 iPad 3 wi-fi "connection fix" for netgear router
http://www.youtube.com/watch?v=XsWS4ha-dn0
Apple's iOS 6 Wi-Fi problems
http://www.zdnet.com/apples-ios-6-wi-fi-problems-linger-on-7000004799/
~~~~~~~~~~~~~~~~~~~~~~~
How to Fix a Poor Wi-Fi Signal on Your iPad
http://ipad.about.com/od/iPad_Troubleshooting/a/How-To-Fix-A-Poor-Wi-Fi-Signal-O n-Your-iPad.htm
iOS Troubleshooting Wi-Fi networks and connections http://support.apple.com/kb/TS1398
iPad: Issues connecting to Wi-Fi networks http://support.apple.com/kb/ts3304
WiFi Connecting/Troubleshooting http://www.apple.com/support/ipad/wifi/
How to Fix: My iPad Won't Connect to WiFi
http://ipad.about.com/od/iPad_Troubleshooting/ss/How-To-Fix-My-Ipad-Wont-Connect -To-Wi-Fi.htm
iOS: Connecting to the Internet http://support.apple.com/kb/HT1695
iOS: Recommended settings for Wi-Fi routers and access points http://support.apple.com/kb/HT4199
How to Quickly Fix iPad 3 Wi-Fi Reception Problems
http://osxdaily.com/2012/03/21/fix-new-ipad-3-wi-fi-reception-problems/
iPad Wi-Fi Problems: Comprehensive List of Fixes
http://appletoolbox.com/2010/04/ipad-wi-fi-problems-comprehensive-list-of-fixes/
Connect iPad to Wi-Fi (with troubleshooting info)
http://thehowto.wikidot.com/wifi-connect-ipad
Fix iPad Wifi Connection and Signal Issues http://www.youtube.com/watch?v=uwWtIG5jUxE
Fix Slow WiFi Issue https://discussions.apple.com/thread/2398063?start=60&tstart=0
How To Fix iPhone, iPad, iPod Touch Wi-Fi Connectivity Issue http://tinyurl.com/7nvxbmz
Unable to Connect After iOS Update - saw this solution on another post.
https://discussions.apple.com/thread/4010130
Note - When troubleshooting wifi connection problems, don't hold your iPad by hand. There have been a few reports that holding the iPad by hand, seems to attenuate the wifi signal.
~~~~~~~~~~~~~~~
If any of the above solutions work, please post back what solved your problem. It will help others with the same problem.
 Cheers, Tom

Activation of Macromedia Flash MX 2004. Even once activated still asks for key each time opened.

I have used both my own key and the one provided by Adobe. I get the message saying the product is activated and it opens but each time I open the application it asks me for the key again? I am using this in a school lab and this is happening on every computer. Can any one help?

i'm pretty sure this is about all the help you can expect, Error: Unable to Activate | Macromedia products though you could do some simple things like save the serial number to a desktop text file so you just have to copy and paste when starting flash mx

Why does aperture keep asking for my activation key each time I open the programme?

I have aperture on iMac and macbook air - everytime I open aperture on air, it asks my name and key number. how do I get it to remember this? why does it do it?
Help please - I am tired of it.

Be sure to enter the serial number, when you are logged in from an account with Administrator priveleges - otherwise the serial number cannot be stored.
Aperture is installed for all users on your mac, so the serial number is written to the system library, not the user library, and this requires read/write access for administrators. Do you enter your serial number using an administrator account?
When did this start? Have you migrated your system from another mac? Then you still may have an older ProAppSystemID file or Aperture cannot write to the System Library.
To stop Aperture asking for the serial number, first check, if you still have an old file "ProAppSystemID" in your System Library.
Quit Aperture.
Go to your MacintoshHD and open the folder "Library", then "Application Support", then "ProApps".
Remove the File "ProAppsSystemID" to the Desktop, if it exist and restart Aperture.
Reenter your serial number, hopefully for the last time.
Sometimes Aperture writes this file to a temporary directory, when it cannot write to the Library. If the above does not work, look at the temporary directory /tmp
Use the Finder's "Go" menu
Go > Got to folder and enter /tmp into the textfield. If you see the file there, move it to its proper location.
Aperture must be running, and you will have to wait a few minutes to be seeing the file appearin the /tmp directory.
In this case you may want to repair the permissions on your system drive; you can do this using the "First Aid" tools in "Disk Utility" (located in Applications > Utilities)
Regards
Léonie

SSL: how to use Multiple Private key/Certificate pair for authentication.

Hi all,
i am implementing SSL in java using X509 Certificate/private key combination.
i have two set of private key/certificate pair.
one is factory default and another is generated at run time.
my problem is to try ssl connection with both pairs on same tcp/ip connection.
e.g. on server side: first try ssl connection with factory default certificate, if it fails try connecting with generated certificate on same tcp/ip connection.
on client side: if generated certificate(this certificate was generated at server side) is present first perform server authentication using this certificate otherwise authenticate server with factory default certificate.
can someone please help and let me know how do i need to configure both ends(client and server) for achieving the same.
Thanks In Advance
Saurabh Ahuja

Client code does not contain any default truststore and needs a certificate for authentication.Of course it does. OpenSSL has a way of doing that: some kind of equivalent for the truststore. None of the stuff you've posted here about generating certificates at runtime has any bearing on that problem.
It's like this. The idea of PKI with SSL is as follows:
- the server has a private key and a signed certificate. Preferably it's signed by a CA that the client already trusts, otherwise if it's self-signed it has to be exported from the server's keystore and imported into the truststores of all the clients.
- the client has a truststore that trusts the server, one way or the other, see above.
- the server's private key is private to it. Nobody else has it. Nobody else can ever get it. If it ever leaks, the server is compromised, and server authentication via that private key now means absolutely nothing. You have lost security.
- the server sends its cert to the client along with a digital signature signed by its private key.
- the client (a) decides whether it trusts the cert, via its truststore, and (b) verifies the digital signature, which establishes that the server owns the certificate.
At this point the server is authenticated to the client and the SSL connection is open. It can now be used as an ordinary socket connection.
If you want client authentication too, you need all the above in reverse as well, i.e. reading server for client and client for server throughout. Note particularly that each client must have its own private key. Otherwise the private key isn't private, so signing something with it doesn't establish ownership, so client authentication isn't valid.
You need to understand all this stuff and relate it to the apparently broken security design of your application. Generating a private key and a certificate at runtime is complete nonsense within the context of PKI and SSL. It proves nothing, establishes nothing, authenticates nothing; it just wastes time.

Private key and digital certificate

I have a keystore . in ordeer to know what it contains ,i opened this keystore with this command ...keytool -list -keystore DemoIdentity.jks
and i got,
Keystore type: jks
Keystore provider: SUN
Your keystore contains 1 entry
demoidentity, Jan 4, 2007, keyEntry, // is it called private key ?
Certificate fingerprint (MD5): 60:42:75:33:31:AA:9A:C6:9D:1A:CD:9F:22:8D:4A:6A // is it called certificate ?
Question :
I still dont understand what a keystore contains. does it contains "private key" + "digital certificate" ?
If so , what are private keys and digital certificate in the above contents ?
Message was edited by:
Unknown_Citizen
Message was edited by:
Unknown_Citizen

The content of a 'keystore' is what you, or the person who provided it, put in it. In this case it looks like all it contains it a public key certificate with an alias of 'demoidentity' .

Cannot export private key: "key not valid for use in specified state"

Hi,
This is a bit of a long story but I hope someone can give us some guidance.
We use authentication certificates issued from our own Enterprise CA to control user and machine authentication via RADIUS/NPS for our wireless network. Certificates are deployed via group policy/autoenrollment. In general this works well but
we have an intermittent problem where user authentication stops working for a user who was fine before. The user certificate looks OK via Certmgr (shows as valid, shows that there is a private key associated with the certificate). The NPS server
logs show that the machine has been authenticated and granted access, but the user in this situation doesn't show up in the server logs at all.
The only solution in this case is to connect to the wired network and request a new certificate for the user (either via certmgr or just by deleting the duff cert and logging off/on again to get the cert via autoenrollment).
The interesting thing is that while a "working" certificate can be exported with no problem, a duff certificate cannot be exported with its private key, giving the error "key not valid for use in specified state". (Obviously the certificates
come from the same template, and the key is not marked unexportable). The key files are present in %userprofile%\Appdata\Roaming\Microsoft\Crypto\RSA and the user permissions on these files look correct.
After much searching of the forums I tried running certutil-repairstore on the duff certificate and that also returned the same error. I also tried an undocumented switch Certutil -user -key -v and again, got a very similar error "Loadkeys returned
key not valid for use in specified state. 0x8009000b (-2146893813)".
I'm assuming that the fact that the key is unexportable/corrupt is also the reason why the certificate can no longer be used for authentication.
Does anyone have any clues as to what might be causing this, and/or if a certificate with a key in this state can be repaired?
Thanks!

I can just share an experience I once had that was somewhat similar:
In this case certificates could sometimes not be enrolled and the CSP came up with a related error message.
The root was the software / driver (?) for a hardware dongle required to run some software. This "driver" added a registry key to the list of CSPs (under these HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider - but I have seen this with
XP, so the exact location might be different now).
This fake CSP entry that had quite a weird name effectively broke other CSPs. After removing the access to / generation of keys worked fine.
So it would be interesting to know if you run some software that is "close to CSPs or cryptography".
Elke

Private key

Hello people,
i'm creating a program that needs to generate private keys,
i've found out that java has built in libraries that support this so i've tried:
                KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
                keyGen.initialize(1024);
                KeyPair keypair = keyGen.genKeyPair();
                PrivateKey privateKey = keypair.getPrivate();
                PublicKey publicKey = keypair.getPublic();but after i set the privateKey i can't find a way to retrieve the actual numbers used in the private key (probably to prevent attacks...)
eventually, all my app really needs, is a table of , lets say, 100 private keys (each one as 2 big primes)
is it possible for me to use the java.security to do that?
thanks for your time.

i still need small ones in the begining. a modolus in
the size of 16 DWORDS is too big for me right now, i
need something like 4.
i guess i have no escape but to generate them myself,
the problem is that i probably won't do it
professionaly :(Well - nobody will generate 32-bit RSA keys "professionally", because it'd take about 2 CPU minutes to break your keys when they're that small. 512 bits was acceptable in the eighties - current best-practice, IIRC, is 2048 bit keys for anything you're serious about protecting, and 4096-bit keys for anything you want to protect for extended periods of time.
Grant

Creating a single public key and multiple private keys

Hello,
I am new to java cryptography. The problem statement is :-
We have an accounting application, with flexibility of number of users and companies. The number of users and companies for this application has to be restricted based on the license the user has. That is the user will download our application via web while the user downloads he has to be given the key according to the license he has requested (i.e. single or multiple users/companies), I am unable to get the logic of private and public keys as such, y because which ever alogorithm i saw will generate a public and private key in pairs hence i am bit confused. Clearly, For ever additional user (or company) we r charging additional amount hence different license (keys) have to be generated dynamically for different users. I think this can be achived by creating one single public key and multiple private keys, but i am not sure . Please help me out.

Hi kazim
would u pls elaborate this , since i am working on same kind of scenario and finding solutions is difficult . Since encryption is done at our end and wen some user downloads an application he is unable to track where it was encrypted . What i have undestand about public /private is that they work in agreement between client and server and both has to come to agreement to share the data. Pls correct me if i am wrong.
Ours is different senario we will send some key in download application and will want him to decrypt it . What would u suggest for this kind of scenario?
Thanks in advance
Janesh

Is there a way to have FF Home remember me, so I don't have to input the sync key, user ID, and password each time? (Perhaps something to do with that "add a device" passcode they completely ignore in the instructions for setting it up?)

Or is my device just having issues, and it SHOULD remember me each time? It's too much hassle to go copy out my sync key each time from where I've saved it in the Notes app, so I almost never use FF Home - I just google or try to guess addresses in Safari, then bookmark them there. (Can one import bookmarks from Sync to Safari? That would help!)

Well if you want a "single signon" experience, the Workstation will need to de join to the domain :-) otherwise it will prompt for the Username and password for authentificaiton.
You can then check the save password box.
For remote user that are NOT on the domain, same behavior, you will be prompted to enter Username/Password.
If a post is helpful, please take a second to hit the green arrow on the left, or mark as answer, thanks.
Jean-Philippe Breton | Senior Microsoft Consultant | MCTS, MCITP, MCT, Lync MVP

'Error while signing data-Private key or certificate of signer not availabl

Hello All,
In my message mapping I need to call a web service to which I need to send a field value consist of SIGNED DATA.
I am using SAP SSF API to read the certificate stored in NWA and Signing the Data as explained in
http://help.sap.com/saphelp_nw04/helpdata/en/a4/d0201854fb6a4cb9545892b49d4851/frameset.htm,
when I have tested using Test tab of message mapping it is working fine and I am able to access the certificate Keystore of NWA(we have created a keystore view and keystore entry to store the certificate) and generate the signed data ,but when I test end to end scenario from ECC system,it is getting failed in mapping with the error
' Error while signing data - Private key or certificate of signer not availableu2019.
Appreciate your expert help to resolve this issue urgently please.
Regards,
Shivkumar

Hi Shivkuar,
Could you please let me know how you were trying to achieve the XML signature.
We have a requirement where we have to sign the XML document and need to generate the target document as following structure.
<Signature>
     <SignedInfo>
         <CanonicalizationMethod />
         <SignatureMethod />
         <Reference>
                 <Transforms>
                 <DigestMethod>
                 <DigestValue>
         </Reference>
    <Reference /> etc.
</SignedInfo>
<SignatureValue />
<KeyInfo />
<Object>ACTUAL PAYLOAD</Object>
</Signature>
I am analyzing the possibility of using the approach that is given in the help sap link that you have posted above. Any inputs will be apprecited.
Thanks and Regards,
Sami.

WLS70 SSL encrypted keys and Certificate Request Generator

Hi,
we are trying to certificate our WLS 7.0. We use the Certificate Request Generator
webapp for generating the request. The generator forces the user to give in a
private key password. But in the server's SSL config tab the field "Use encrypted
Keys" is fixed to "false" (in WLS 6.1 this field is a checkbox). Is this a bug
in WLS7.0?

Hi Alain,
thanks for your workaround. We will check it out ... although I've been instructed
on the BEA admin trainee to never change config.xml manually :)
"Alain Hsiung" <[email protected]> wrote:
Hi Joern
consider it a bug or not, you can go to the file config.xml and edit
the
XML attribute "KeyEncrypted" of the XML element "SSL" to "true".
Hope this helps.
Regards
Alain Hsiung, Ideartis Inc.
"Joern Wohlrab" <[email protected]> wrote in message
news:[email protected]..
Hi,
we are trying to certificate our WLS 7.0. We use the Certificate RequestGenerator
webapp for generating the request. The generator forces the user togive
in a
private key password. But in the server's SSL config tab the field"Use
encrypted
Keys" is fixed to "false" (in WLS 6.1 this field is a checkbox). Isthis a
bug
in WLS7.0?

SSL & generated private key

I generated a CSR with the certificate servlet. I modified
config.xml in order to set the right files :
<SSL Enabled="true" ListenPort="7002" Name="test2" ServerCertificateChainFileName="config/mydomain/cacrt.pem"
ServerCertificateFileName="config/mydomain/servercert.pem"
ServerKeyFileName="config/mydomain/serverkey.der"/>
The serverkey.der is a copy of the file generated by the
certificate servlet.
At startup the following error occurs :
<30 juil. 01 20:23:26 CEST> <Alert> <WebLogicServer> <Security configuration problem
with certificate file config/mydomain/serverkey.der, java.io.EOFException>
java.io.EOFException
at weblogic.security.Utils.inputByte(Utils.java:133)
at weblogic.security.ASN1.ASN1Header.inputTag ASN1Header.java:125)
at weblogic.security.ASN1.ASN1Header.input(ASN1Header.java:119)
at weblogic.security.RSAPrivateKey.input(RSAPrivateKey.java:119)
at weblogic.security.RSAPrivateKey.<init>(RSAPrivateKey.java:91)
at weblogic.t3.srvr.SSLListenThread.<init>(SSLListenThread.java:397)
at weblogic.t3.srvr.SSLListenThread.<init>(SSLListenThread.java:300)
at weblogic.t3.srvr.T3Srvr.initializeListenThreads(T3Srvr.java:1028)
at weblogic.t3.srvr.T3Srvr.initialize(T3Srvr.java:475)
at weblogic.t3.srvr.T3Srvr.run(T3Srvr.java:197)
at weblogic.Server.main(Server.java:35)
More over the conversion of the serverkey.der in serverkey.pem
with openssl gives the following error :
openssl rsa -in serverkey.der -outform PEM -out serverkey.pem
read RSA key
unable to load key
1276:error:0906D06C:PEM routines:PEM_read_bio:no start line:./crypto/pem/pem_lib
.c:662:Expecting: ANY PRIVATE KEY
and reading the file by the default W2K reader gives an error too.
Need help !

Agree with S Guna, the ISP/Certificate Authority won't generate the private key, the request from your Lync server does. So the private key is already sitting on your Lync 2010 Server. Once you import the certificate generated by the certificate
authority, the private key and certificate should be paired and can be assigned to Lync.
Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question please click "Mark As Answer".
SWC Unified Communications

AZURE The specified certificate could not be found in the LocalMachine certificate store,or the certificate does not have a private key.

Hello,
I try to make a HV website in Azure. It took me hours to figure out how to make a HV certificate with my own password. But I figured it out. With the HV application manager I uploaded the certificate to the HV platform. This worked fine. Then I created a
c# project with also works well on my local machine.
This is the code I use in the web.config
<appSettings>
<add key="ApplicationId" value="24ee15be-1497-4719-ad70-d1223adbf021" />
<add key="ShellUrl" value="https://account.healthvault-ppe.co.uk/" />
<add key="HealthServiceUrl" value="https://platform.healthvault-ppe.com/platform/" />

<add key="NonProductionActionUrlRedirectOverride" value="Redirect.aspx" />

<add key="WCPage_ActionHome" value="default.aspx" />
<add key="WCPage_ActionAppAuthSuccess" value="default.aspx" />
<add key="WCPage_ActionSignOut" value="SignedOut.aspx" />
</appSettings>
Next step is to deploy the site to Azure. I was able to upload the certicate to Azure.
After deploy I get the following error:
System.Security.SecurityException: The specified certificate, CN=WildcatApp-24ee15be-1497-4719-ad70-d1223adbf021, could not be found
in the LocalMachine certificate store,or the certificate does not have a private key.
I checked the certificate on another server with a different key in the web.config
<add key="ApplicationCertificateFileName" value="c:\Zodos\website\WildcatApp-24ee15be-1497-4719-ad70-d1223adbf021.pfx"/>
This gives me this error:
Exception Details: System.Security.Cryptography.CryptographicException: The specified network password is
not correct.
So the procedure I followed definitely was not correct:
It works on my local machine
It doesn't work on another server or on Azure
I can see that the procedure I follow is not correct, but what am I doing wrong?
Wilfred

I am having the same problem. I see I have updates thru the Mac App Store but when I try and run the System updates in the Mac App Store it errors out. But I can update third party apps.
Have even tried going thru Terminal to check for software updates but still have same error claiming it can not find the hostname server.
Jefre

Certificate [Thumbprint SOME THUMBPRINT] issued to 'CLientMachineName' doesn't have private key or caller doesn't have access to private key.

Hi,    We are trying to get a client to communicate with the primary Config Manager Site System(MP/DP).
We have a Config Manager Client Template that was setup using this guide.
http://technet.microsoft.com/en-us/library/gg682023.aspx
We have a Client Cert on the primary site system server (primary config manager server) based on this template and it meets the requirements specified in this document
http://technet.microsoft.com/en-us/library/gg699362.aspx
         Enhanced Key Usage value must contain
Client Authentication (1.3.6.1.5.5.7.3.2).
         Client computers must have a unique value in the Subject Name field or in the Subject Alternative Name field.
         SHA-1and SHA-2 hash algorithms are supported.
         Maximum supported key length is 2048 bits.
The Cert that we generated for the client meets the same requirements and shows the exact same template id but has a different subject name and alternate name (which is the clients machine name).
With this setup, we still get the following error
Certificate [Thumbprint SOME THUMBPRINT] issued to 'CLientMachineName' doesn't have private key or caller doesn't have access to private key.
Both the site system and client have the same trusted root cert installed.
What are we missing or what can we check?    Does the cert check process only need the client certs on both the site system and the client to be from the same template?
Here is a snippet of the clientidmanagerstartup.log
<![LOG[HTTPS is enforced for Client. The current state is 63.]LOG]!><time="15:02:32.057+300" date="03-12-2014" component="ClientIDManagerStartup" context="" type="1" thread="716" file="ccmutillib.cpp:395">
<![LOG[Begin searching client certificates based on Certificate Issuers]LOG]!><time="15:02:32.058+300" date="03-12-2014" component="ClientIDManagerStartup" context="" type="1" thread="716"
file="ccmcert.cpp:3833">
<![LOG[Certificate Issuer 1 [CN=THE_NAME_OFTHE_CA; DC=DOMAIN; DC=LOCAL]]LOG]!><time="15:02:32.058+300" date="03-12-2014" component="ClientIDManagerStartup" context="" type="1" thread="716"
file="ccmcert.cpp:3849">
<![LOG[Based on Certificate Issuer 'THE_NAME_OFTHE_CA' found Certificate [Thumbprint SOMETHUMBPRINT_1] issued to 'CLIENTMACHINENAME']LOG]!><time="15:02:32.082+300" date="03-12-2014" component="ClientIDManagerStartup"
context="" type="1" thread="716" file="ccmcert.cpp:3931">
<![LOG[Begin validation of Certificate [Thumbprint SOMETHUMBPRINT_1] issued to 'CLIENTMACHINENAME']LOG]!><time="15:02:32.082+300" date="03-12-2014" component="ClientIDManagerStartup" context="" type="1"
thread="716" file="ccmcert.cpp:1245">
<![LOG[Completed validation of Certificate [Thumbprint SOMETHUMBPRINT_1] issued to 'CLIENTMACHINENAME']LOG]!><time="15:02:32.085+300" date="03-12-2014" component="ClientIDManagerStartup" context="" type="1"
thread="716" file="ccmcert.cpp:1386">
<![LOG[Completed searching client certificates based on Certificate Issuers]LOG]!><time="15:02:32.085+300" date="03-12-2014" component="ClientIDManagerStartup" context="" type="1" thread="716"
file="ccmcert.cpp:3992">
<![LOG[Begin to select client certificate]LOG]!><time="15:02:32.085+300" date="03-12-2014" component="ClientIDManagerStartup" context="" type="1" thread="716" file="ccmcert.cpp:4073">
<![LOG[Begin validation of Certificate [Thumbprint SOMETHUMBPRINT_1] issued to 'CLIENTMACHINENAME']LOG]!><time="15:02:32.085+300" date="03-12-2014" component="ClientIDManagerStartup" context="" type="1"
thread="716" file="ccmcert.cpp:1245">
<![LOG[Certificate [Thumbprint SOMETHUMBPRINT_1] issued to 'CLIENTMACHINENAME' doesn't have private key or caller doesn't have access to private key.]LOG]!><time="15:02:32.086+300" date="03-12-2014" component="ClientIDManagerStartup"
context="" type="2" thread="716" file="ccmcert.cpp:1372">
<![LOG[Completed validation of Certificate [Thumbprint SOMETHUMBPRINT_1] issued to 'CLIENTMACHINENAME']LOG]!><time="15:02:32.086+300" date="03-12-2014" component="ClientIDManagerStartup" context="" type="1"
thread="716" file="ccmcert.cpp:1386">
<![LOG[Raising event:
instance of CCM_ServiceHost_CertRetrieval_Status
   ClientID = "GUID:GUID";
   DateTime = "20140312200232.090000+000";
   HRESULT = "0x87d00283";
   ProcessID = 6380;
   ThreadID = 716;
]LOG]!><time="15:02:32.090+300" date="03-12-2014" component="ClientIDManagerStartup" context="" type="1" thread="716" file="event.cpp:706">
<![LOG[Failed to submit event to the Status Agent. Attempting to create pending event.]LOG]!><time="15:02:32.092+300" date="03-12-2014" component="ClientIDManagerStartup" context="" type="2" thread="716"
file="event.cpp:728">
<![LOG[Raising pending event:
instance of CCM_ServiceHost_CertRetrieval_Status
   ClientID = "GUID:GUID";
   DateTime = "20140312200232.090000+000";
   HRESULT = "0x87d00283";
   ProcessID = 6380;
   ThreadID = 716;
]LOG]!><time="15:02:32.092+300" date="03-12-2014" component="ClientIDManagerStartup" context="" type="1" thread="716" file="event.cpp:761">
<![LOG[Unable to find PKI Certificate matching SCCM certificate selection criteria. 0x87d00283]
Thanks Lance

Hi,
It seems that there are something wrong with you PKI system.
Here are some steps for your reference.
SCCM 2012: Part II – Certificate Configuration
http://gabrielbeaver.me/2012/08/sccm-2012-part-ii-certificate-configuration/
Note: Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Certificate Assistant Generates it's own private key each time

Similar Messages

Maybe you are looking for