Certificate [Thumbprint SOME THUMBPRINT] issued to 'CLientMachineName' doesn't have private key or caller doesn't have access to private key.

Question

Hi,    We are trying to get a client to communicate with the primary Config Manager Site System(MP/DP).
We have a Config Manager Client Template that was setup using this guide. 
http://technet.microsoft.com/en-us/library/gg682023.aspx
We have a Client Cert on the primary site system server (primary config manager server)  based on this template and it meets the requirements specified in this document
http://technet.microsoft.com/en-us/library/gg699362.aspx
         Enhanced Key Usage value must contain
Client Authentication (1.3.6.1.5.5.7.3.2).   
         Client computers must have a unique value in the Subject Name field or in the Subject Alternative Name field.
         SHA-1and SHA-2 hash algorithms are supported.
         Maximum supported key length is 2048 bits.
The Cert that we generated for the client meets the same requirements and shows the exact same template id but has a different subject name and alternate name (which is the clients machine name).
With this setup, we still get the following error
Certificate [Thumbprint  SOME THUMBPRINT] issued to 'CLientMachineName' doesn't have private key or caller doesn't have access to private key.
Both the site system and client have the same trusted root cert installed.
What are we missing or what can we check?    Does the cert check process only need the client certs on both the site system and the client to be from the same template?
Here is a snippet of the clientidmanagerstartup.log
<![LOG[HTTPS is enforced for Client. The current state is 63.]LOG]!><time="15:02:32.057+300" date="03-12-2014" component="ClientIDManagerStartup" context="" type="1" thread="716" file="ccmutillib.cpp:395">
<![LOG[Begin searching client certificates based on Certificate Issuers]LOG]!><time="15:02:32.058+300" date="03-12-2014" component="ClientIDManagerStartup" context="" type="1" thread="716"
file="ccmcert.cpp:3833">
<![LOG[Certificate Issuer 1 [CN=THE_NAME_OFTHE_CA; DC=DOMAIN; DC=LOCAL]]LOG]!><time="15:02:32.058+300" date="03-12-2014" component="ClientIDManagerStartup" context="" type="1" thread="716"
file="ccmcert.cpp:3849">
<![LOG[Based on Certificate Issuer 'THE_NAME_OFTHE_CA' found Certificate [Thumbprint SOMETHUMBPRINT_1] issued to 'CLIENTMACHINENAME']LOG]!><time="15:02:32.082+300" date="03-12-2014" component="ClientIDManagerStartup"
context="" type="1" thread="716" file="ccmcert.cpp:3931">
<![LOG[Begin validation of Certificate [Thumbprint SOMETHUMBPRINT_1] issued to 'CLIENTMACHINENAME']LOG]!><time="15:02:32.082+300" date="03-12-2014" component="ClientIDManagerStartup" context="" type="1"
thread="716" file="ccmcert.cpp:1245">
<![LOG[Completed validation of Certificate [Thumbprint SOMETHUMBPRINT_1] issued to 'CLIENTMACHINENAME']LOG]!><time="15:02:32.085+300" date="03-12-2014" component="ClientIDManagerStartup" context="" type="1"
thread="716" file="ccmcert.cpp:1386">
<![LOG[Completed searching client certificates based on Certificate Issuers]LOG]!><time="15:02:32.085+300" date="03-12-2014" component="ClientIDManagerStartup" context="" type="1" thread="716"
file="ccmcert.cpp:3992">
<![LOG[Begin to select client certificate]LOG]!><time="15:02:32.085+300" date="03-12-2014" component="ClientIDManagerStartup" context="" type="1" thread="716" file="ccmcert.cpp:4073">
<![LOG[Begin validation of Certificate [Thumbprint SOMETHUMBPRINT_1] issued to 'CLIENTMACHINENAME']LOG]!><time="15:02:32.085+300" date="03-12-2014" component="ClientIDManagerStartup" context="" type="1"
thread="716" file="ccmcert.cpp:1245">
<![LOG[Certificate [Thumbprint SOMETHUMBPRINT_1] issued to 'CLIENTMACHINENAME' doesn't have private key or caller doesn't have access to private key.]LOG]!><time="15:02:32.086+300" date="03-12-2014" component="ClientIDManagerStartup"
context="" type="2" thread="716" file="ccmcert.cpp:1372">
<![LOG[Completed validation of Certificate [Thumbprint SOMETHUMBPRINT_1] issued to 'CLIENTMACHINENAME']LOG]!><time="15:02:32.086+300" date="03-12-2014" component="ClientIDManagerStartup" context="" type="1"
thread="716" file="ccmcert.cpp:1386">
<![LOG[Raising event:
instance of CCM_ServiceHost_CertRetrieval_Status
    ClientID = "GUID:GUID";
    DateTime = "20140312200232.090000+000";
    HRESULT = "0x87d00283";
    ProcessID = 6380;
    ThreadID = 716;
]LOG]!><time="15:02:32.090+300" date="03-12-2014" component="ClientIDManagerStartup" context="" type="1" thread="716" file="event.cpp:706">
<![LOG[Failed to submit event to the Status Agent. Attempting to create pending event.]LOG]!><time="15:02:32.092+300" date="03-12-2014" component="ClientIDManagerStartup" context="" type="2" thread="716"
file="event.cpp:728">
<![LOG[Raising pending event:
instance of CCM_ServiceHost_CertRetrieval_Status
    ClientID = "GUID:GUID";
    DateTime = "20140312200232.090000+000";
    HRESULT = "0x87d00283";
    ProcessID = 6380;
    ThreadID = 716;
]LOG]!><time="15:02:32.092+300" date="03-12-2014" component="ClientIDManagerStartup" context="" type="1" thread="716" file="event.cpp:761">
<![LOG[Unable to find PKI Certificate matching SCCM certificate selection criteria. 0x87d00283]
Thanks Lance

Answer 1

Hi,
It seems that there are something wrong with you PKI system.
Here are some steps for your reference.
SCCM 2012: Part II – Certificate Configuration
http://gabrielbeaver.me/2012/08/sccm-2012-part-ii-certificate-configuration/
Note: Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.