Old clients won't switch from Self-Signed Certs to PKI.

Greetings.
I am wondering if anyone can give me advise on problem I am having with some of my sccm clients.
When I originally deployed SCCM i used self signed certs on clients.
We needed to add MAC and Linux support and MAC clients won't work without PKI, so I following this http://technet.microsoft.com/en-us/library/gg682023.aspx to configure Certificate Authority.
It all seemed work well, I can now join MAC client with auto-enroll and all machines are requesting client certificates and I had couple of machine with new push on windows site installed with PKI.
So right now I have about 250 windows clients, only 22 of them use PKI and the rest keeps using self-signed certs.
I foolishly switched main site settings, MP settings and DP point settings to use https only.
As a result I lost all self-signed clients and have full log for mpcontrol saying that it's rejecting clients cause they certificate cannot be validated.
I logged in to couple of those machines and MMC i can see that it did enroll machine with valid Client Cert but Configuration Manager client itself still saying that it's using self signed one.
Am I missing a step that I need to do to make sure that all those clients switch to PKI?

It is. but how can i redeploy them?
I was under impression auto push won't reinstall them. If i do deployment - that seem to reuse existing configuration and still use self signed on old machines.
How can i verify that it does push clients to machine that already have it correctly and start using new config and not reuse old one.
I even tried removing clients from couple of machines and see if it gets pushed again on them with proper config and those machines don't seem to get client but used to get it fine before. I keep getting new machines being added to domain and they get client
pushed to them, but anything that had client with self signed doesn't seem to be happy.

Similar Messages

2960G switch - I don't want the self signed cert

I have a number of 2960's and just got a new one and have some time to play around so I thought I'd take an extra few minutes to make a cert in my MS certificate server which should be trusted by Windows domain computers, then I wouldn't get the annoying cert warning in my browser. I recently set up Verisign certs on a couple of ASAs for AnyConnect so I thought it wouldn't be a big deal. I think I got all of the cert stuff set up correctly but when I try and connect to the switch with a browser I still get the warning that it isn't from a trusted source - and - the switch keeps making self signed certs even after I remove them. The ASA had a easy command to tell it to use a specific cert but after looking through docs and using the "?" in all sorts of possible commands at the CLI, I am unable to figure this one out.
Anyone have an answer or a doc for this?

The apps are tied to your account, so unless he has access to your account, then when he connects the iPad to his computer they will be removed (and he won't be able to download updates to them without your password). In terms of photos, if they were originally synced from a computer, then again they will be removed if he tries to sync his own photos to it.

Removing Lync Self-Signed Cert from Personal Store

Short story, the Lync client self-signed cert is creating an issue with our updated PKI infrastructure. In testing, when a user logs in with the new Infra. PKI chain the Lync client give a certificate error. When the *usersup*.cer is deleted
from the personal store, everything is fine. I've turned off the issuing of the client cert on the server side and running of AD authentication is fine. I need to automate the removal of 6K+ user's personal certs. Below is a PS script
that does what I need to do but the prompt has to be elevated and elevating prompts for that many users poses an issue, if anyone has experience with this and has an alternative solution, please feel free to share.
$certs = Get-ChildItem cert:\CurrentUser\My | where { $_.Issuer –like 'CN=Communications Server' }
foreach ($cert in $certs) {
    $store = Get-Item $cert.PSParentPath
    $store.Open('ReadWrite')
    $store.Remove($cert)
    $store.Close()

I think you can assign appropriate permission to run the command. But I am not sure about the Powershell. I would recommend you post the thread in the following forum:
http://social.technet.microsoft.com/Forums/windowsserver/en-US/home?forum=winserverpowershell
Lisa Zheng
TechNet Community Support

Psc won't switch from copy to print

I so need help! My hp psc 750 won't switch from copy mode to print mode. I have a job I need to print and when I go to print it, it says printer error and puts my print job in queue. Nothing is waiting to copy, it just won't go to print mode. Help please!!!

I would start by checking the USB cable is connected between the printer and computer. Next make sure the printer driver is installed and that the printer is not set to "use printer offline".
Bob Headrick, HP Expert
I am not an employee of HP, I am a volunteer posting here on my own time.
If your problem is solved please click the "Accept as Solution" button ------------V
If my answer was helpful please click the "Thumbs Up" to say "Thank You"--V

Importing self signed cert

Hi all,
I need to import a self signed cert to our webdav server. I'm running maven 2 to deploy, and I can't get the ssl certificate into the keystore because I can't find it! Normally I've used the "keytool -import.." to import certs. I recently switched to OS X from Linux/Winbloze, so any help would be greatly appreciated!
Thanks,
Todd

You need to import the certification in the file b64InternetCertificate.txt in the /sysman/config directory of your agent. Full instructions are in chapter 4, 4.7.2 Configuring Beacons to Monitor Web Applications Over HTTPS.

SCCM 2012 Default self signed Cert expired...

SCCM 2012 Default self signed Cert expired - how do I renew it?

The default selfsigned cert that gets generated with the installation - can be found in administration - security - Certificates (This is Sccm 2012 RTM)
Yes, I know this is an old post, but I’m trying to clean them up. Did you solve this problem, if so what was the solution?
I will bring this back to Kent point, which one of the Certs are you talking about. You can see form the screenshot that I have 6 certs, 3 DP and 3 Boot cert. You can also see that the 3 DP server have a 100 year life and the 3 Boot certs only have 1 year.
If you are talking about the boot certs then just create the boot image.
Garth Jones | My blogs: Enhansoft and
Old Blog site | Twitter:
@GarthMJ

EAP-GTC & self signed certs

I am looking at deploying EAP-GTC with a novell ldap directory and ACS 3.3.4. Could I use a self signed cert with this or do have have to have a CA sign the cert? All clients will be Cisco aironet cards.

Hi,
Self signed certificate will be ok.
Regards,
Vivek

Self signed cert and AD root cert

I have an organization running Exchange 2007, they're self signed cert expired so I created a new one, they're AD root certificate also expired so I regenerated this also. The problem is when clients log on a certificate error comes up. I then have to log onto the server and transfer both certificate to the client machines and install them manually, I have to repeat this every time a user needs to access mail. Can anyone help with a resolution
This topic first appeared in the Spiceworks Community

I have an organization running Exchange 2007, they're self signed cert expired so I created a new one, they're AD root certificate also expired so I regenerated this also. The problem is when clients log on a certificate error comes up. I then have to log onto the server and transfer both certificate to the client machines and install them manually, I have to repeat this every time a user needs to access mail. Can anyone help with a resolution
This topic first appeared in the Spiceworks Community

Local, self-signed cert for SSL IMAP on Tiger?

I have a co-located Xserve running Server 10.4.11 (Up time: 380 days!) with IMAP, where I have admin access to install SSL certificates, but I don't quite have the justification to purchase one from a CA.
I also have several Mac computers where I read my email via IMAP with SSL encryption, and I was wondering if there is any way that I could install a self-signed certificate on my local computers that matches my Xserve and would be sufficient to make Mail.app stop complaining about my server.
I've been searching the web for tutorials on SSL, thinking that there must be some kind of provision within SSL where I could just set up all machines to be aware of a self-signed certificate in a protected file somewhere on each computer, and I assume that it should be possible to make SSL happy to talk between my own computers. But it seems that most SSL tutorials focus on https, not IMAP or other non-web networking connections. Also, I have a sinking feeling that if I did find information, then it might not be appropriate for the exact directory structure of Tiger. If anyone can help or provide pointers, it would be most appreciated.
P.S. I could potentially used a "free" signed certificate, but it is attached to a virtual domain that I am hosting on my Xserve, and I assume that it wouldn't match the domain of my email unless I juggle things around. Also, that free cert would eventually expire, and then I'll be back to the current situation of needing to use a self-signed cert.

Never mind. I figured it out.
First of all, my Xserve certificate did not have the full FQDN, just a convenient subset. I created another self-signed cert with the true FQDN. I saw some hints around the web saying that Mail.app will always complain if the DN does not match.
Second, it turns out that Keychain Access is where the local certs live, and in Tiger I needed to drag the cert to my Desktop, open it, and store it in the x509 section.
All is good. Now to see how my iPhone likes the new certs...

OWA using self signed cert

I have a customer that just bought a blackberry, and I have other customers that use them via OWA for email. Those customers have a Cert from verisign, and use ssl for the owa site. This latest customer uses SSL, however, it is a self-signed cert. This isn't a problem for WM5 devices, since I can install the cert on them... but how will this effect this blackberry I want to put in place.
My understanding is that blackberry contacts my OWA, and then pushes the email it gets to the device.
not using SSL is not an option.
Will blackberry still connect to the OWA site even though the cert will show as untrusted for them?

Regardless of whether the Cert is trusted or not. When entering the server information ensure you are using the full https:// owa address and it should work fine.

"I do not get any message or option to add exception" - Using Self signed cert -Images does not load

Wr are have two web servers one for app and another for loading images. Both are behind Kemp Load balancer and are using self signed certs from the load balancer. The images does not load when using Firefox 3.x. I load with IE and Firefox 2.x. With firefox 3.x it does not give a message to "add exception". I only get one certificate message to add exception for the app server. I do not get the certificate message or pop up for the imaging server with Firefox 3.x.
== This happened ==
Every time Firefox opened
== Always ==
== User Agent ==
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)

You have a lot of information in packed in the "More system details..." (in the right-hand column), where it looks like you found a solution. If not take a look at "Problematic Extensions" the AVG Free installation of their "'''AVG Free Search'''" can cause such problems. Directions to fix that are specific and involve reinstalling AVG Free without the Link Scanner component.
* http://kb.mozillazine.org/Problematic_extensions

Applet signed w/ self-signed cert - different behaviors w different servers

Folks,
I'd really appreciate your help with the following.
I'd like to deploy an applet as a signed jar. Probably at least in the beginning, and maybe indefinitely, I'd like to sign it with a self-signed cert. When I've tested this under Linux, loading the applet in a browser running on my desktop, from an apache2 webserver also running on the desktop, I get the expected behavior - I get a security dialog reporting that the applet was signed by an unrecognized CA, but allowing me to accept the applet's signature. However, when I try loading the applet from my server (i.e, browser still running on my desktop, but now loading the applet from the real webserver, which is also apache2), I don't get a security dialog, and the applet fails silently.
Is there some way of configuring the webserver so that the security dialog is presented for a self-signed applet? What explains this difference?
Thanks much,
Matthew Fleming
DermVision, LLC

Double post answer has been given and ignored:
http://forum.java.sun.com/thread.jspa?threadID=569012&messageID=2812525#2812525

Applet signed w/ self-signed cert - different behavior w/ different servers

Folks,
I'd really appreciate your help with the following.
I'd like to deploy an applet as a signed jar. Probably at least in the beginning, and maybe indefinitely, I'd like to sign it with a self-signed cert. When I've tested this under Linux, loading the applet in a browser running on my desktop, from an apache2 webserver also running on the desktop, I get the expected behavior - I get a security dialog reporting that the applet was signed by an unrecognized CA, but allowing me to accept the applet's signature. However, when I try loading the applet from my server (i.e, browser still running on my desktop, but now loading the applet from the real webserver, which is also apache2), I don't get a security dialog, and the applet fails silently.
Is there some way of configuring the webserver so that the security dialog is presented for a self-signed applet? What explains this difference?
Thanks much,
Matthew Fleming
DermVision, LLC

policy files or Runtime Parameters could change the default behavior.
The java.policy could have a line like this:
permission java.lang.RuntimePermission "usePolicy";
A full trace might show you what's going wrong.
To turn the full trace on (windows) you can start the java console, to be found here:
C:\Program Files\Java\j2re1.4...\bin\jpicpl32.exe
In the advanced tab you can fill in something for runtime parameters fill in this:
-Djavaplugin.trace=true -Djavaplugin.trace.option=basic|net|security|ext|liveconnect
if you cannot start the java console check here:
C:\Documents and Settings\userName\Application Data\Sun\Java\Deployment\deployment.properties
I think for linux this is somewhere in youruserdir/java (hidden directory)
add or change the following line:
javaplugin.jre.params=-Djavaplugin.trace\=true -Djavaplugin.trace.option\=basic|net|security|ext|liveconnect
for 1.5:
deployment.javapi.jre.1.5.0.args=Djavaplugin.trace\=true -Djavaplugin.trace.option\=basic|net|security|ext|liveconnect
The trace is here:
C:\Documents and Settings\your user\Application Data\Sun\Java\Deployment\log\plugin...log
I think for linux this is somewhere in youruserdir/java (hidden directory)

IMAP SSL doesnt work in iOS 8.0.2 with self-signed cert.

Got several mailaccounts setup on my iPhone, four of them is LDAP SSL with the server running self-signed cert (expires 2039).
When I upgraded to iOS 8.0.2 (iPhone 5S) I got problem with Network settings so I did a "Reset Network Settings" (General > Reset).
After that all my LDAP SSL based emailaccount cannot be "Verified". I have tried reinstall them all but cannot even set them up anymore!!
I then setup with EXACTLY the same settings in Mail on my MacAir and it did work like a charm instantly. (Im working as a IT Tech so this is peanuts).
I have even tried to import the certificate (.pem) from Keyaccess Chain into my iPhone. So that one is installed.
In older iOS you could tell "Continue" when it said "Certificate is not trusted". Just clicked Continue and it worked anyway!
What to do?
In iOS 8.0.2 this is not showing to accept the certificate! Now it only shows:

Nothing anyone here can do, but you should report it to Apple: http://www.apple.com/feedback/

Activate SSL with OpenSSL Self-Signed Cert

Dear Expert,
Anyone can give me guidance on how to activate and create ssl cert in Java IM using openssl self-signed cert.
thanks

Here how I make it work. Some of the tips is from jay in this forum
Instant Messaging with SSL
Let say I have Messaging, Directory, IM server in 1 box.
Let's create a cert
# cd /etc/opt/SUNWiim/default/config/
a) Sun [TM] ONE Messaging Server 6.1 and Sun [TM] ONE Directory Server 5.2 were installed from JES2 on the same box
b) The server_root directory for Directory Server is the default: /var/opt/mps/serverroot
c) The server_root directory for Messaging Server is also the default: /opt/SUNWmsgsr
1. Login to the console and do a Certificate Request
a) cd /var/opt/mps/serverroot
b) ./startconsole &
c) Login to the main console as "cn=Directory Manager"
d) Select and open the "Messaging Server" console
e) Highlight the tab called "Tasks" at the top
f) Select "Manage Certificates"
g) Console will ask for a password for the security database. Please enter a password twice and make sure that you remember it. This will create the following two files under "/var/opt/mps/serverroot/alias" directory:
-rw------- 1 mailsrv other 65536 Aug 12 13:57 msg-config-cert8.db
-rw------- 1 mailsrv other 32768 Aug 12 13:57 msg-config-key3.db
NOTE: Please make sure that:
- either the owner of the files is the messaging server user ( mailsrv in this case ),
-or the permission is appropriate for the mail server user to at least read it.
h) Once you reach the "Manage Certificate" window, please make a "Certificate Request" by filing up the appropriate questions
i) Once you are done, you get a CSR , which looks something like this:
-----BEGIN NEW CERTIFICATE REQUEST-----
MIIBszCCARwCAQAwczELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWE x
DzANBgNVBAcTBm5ld2FyazEMMAoGA1UEChMDc21pMQ0wCwYDVQQLEwRhdGFjMSEw
HwYDVQQ DExhwb3BleWUuYXRhYy5lYmF5LnN1bi5jb20wgZ8wDQYJKoZIhvcNAQEB
BQADgY0AMIGJAoGBALF eXVTFDj/1eONPzV/dAZ0dBKdstl+u+L/DTdw1sCXXOdNG
MzYeTUu9g/g0dXL/bniF31M0OkoW+6O 5mshySv/KXS9QcoPngSKS6wuL8kNlYKQR
Dw97WCS1uaqubAK/kir4hDmL7X9Rf29EFHDSFOWjeOJ /M7aqFWCfR5sTeSIFAgMB
AAGgADANBgkqhkiG9w0BAQQFAAOBgQCeYwptiL/j7Bcs0DtGYiOlMMs utezF1COC
4+wHt/p+LtQkvQWBoXisqN6YlGfZPXOCdUyA+RwU7BxjX9IQLP+9HLHfQyLzvCKb
boKKpjIc8Ci+tmibM5QkgTxu4L7yeCR/PiplgVPttHNT2Qr9cxHLLBvIO6N1GOE8
VBoq0pC5SA= =
-----END NEW CERTIFICATE REQUEST-----
Please maintain and preserve this CSR , since you will be sending it to the Certificate Authority ( CA ) so they can issue you a Certificate
# openssl genrsa -des3 -out ca.key 4096
# openssl req -new -x509 -days 3650 -key ca.key -out ca.crt
# openssl x509 -req -days 3650 -in file.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out server-cert.crt
# cp -p /var/opt/mps/serverroot/alias/msg-config-key3.db key3.db
# cp -p /var/opt/mps/serverroot/alias/msg-config-cert8.db cert8.db
# cp -p /var/opt/mps/serverroot/alias/secmod.db .
# cat sslpassword.conf
Internal (Software) Token:password
# cat /etc/opt/SUNWiim/default/config/iim.conf
iim.comm.modules = "iim_server,iim_mux,iim_wd"
iim.smtpserver = "www.esuria.com.bn"
iim.instancedir = "/opt/SUNWiim"
iim.instancevardir = "/var/opt/SUNWiim/default"
iim.user = "root"
iim.group = "root"
iim.config.version = "1.1"
iim_ldap.host = "www.esuria.com.bn:389"
iim_ldap.searchbase = "o=esuria.com.bn,dc=esuria,dc=com,dc=bn"
iim_ldap.loginfilter = "(&(objectclass=inetorgperson)(uid={0}))"
iim_ldap.usergroupbyidsearchfilter = "(|(&(objectclass=groupofuniquenames)(dn={0
}))(&(objectclass=inetorgperson)(uid={0})))"
iim_ldap.usergroupbynamesearchfilter = "(|(&(objectclass=groupofuniquenames)(cn=
{0}))(&(objectclass=inetorgperson)(cn={0})))"
iim_ldap.allowwildcardinuid = "False"
iim_ldap.userclass = "inetOrgPerson"
iim_ldap.groupclass = "groupOfUniqueNames"
iim_ldap.groupbrowsefilter = "(objectclass=groupofuniquenames)"
iim_ldap.searchlimit = "40"
iim_ldap.userdisplay = "cn"
iim_ldap.groupdisplay = "cn"
iim_ldap.useruidattr = "uid"
iim_ldap.groupmemberattr = "uniquemember"
iim_ldap.usermailattr = "mail"
iim_ldap.resynctime = "720"
iim_ldap.usergroupbinddn = "cn=Directory Manager"
iim_ldap.usergroupbindcred = "password"
iim_ldap.useidentityadmin = "false"
iim.log.iim_server.severity = "INFO"
iim.log.iim_mux.severity = "ERROR"
iim.log.iim_wd.severity = "ERROR"
iim_server.domainname = "esuria.com.bn"
iim_server.useport = "True"
iim_server.port = "5269"
iim_server.usesslport = "False"
iim_server.sslport = "5223"
iim_server.enable = "True"
iim_server.clienttimeout = "15"
iim_server.usesso = "0"
iim.policy.modules = "iim_ldap"
iim.userprops.store = "file"
iim_mux.listenport = "www.esuria.com.bn:5222"
iim_mux.serverport = "www.esuria.com.bn:45222"
iim_mux.enable = "true"
iim_mux.numinstances = "2"
iim_mux.maxthreads = "10"
iim_mux.maxsessions = "1000"
iim_mux.usessl = "on"
iim_mux.secconfigdir = "/etc/opt/SUNWiim/default/config"
iim_mux.keydbprefix =
iim_mux.certdbprefix =
iim_mux.secmodfile = "secmod.db"
iim_mux.certnickname = "server-cert"
iim_mux.keystorepasswordfile = "sslpassword.conf"
iim_wd.enable = "true"
iim_wd.period = "300"
iim_wd.maxRetries = "10"
-open http://www.esuria.com.bn/im/en/im.jnlp
-click More Detail and enable Use SSL

Old clients won't switch from Self-Signed Certs to PKI.

Similar Messages

Maybe you are looking for