topic Re: Re:Creating and using a Intel vPro Certificate mit own CA in Intel vPro® Platform

Creating and using a Intel vPro Certificate mit own CA

Fabian8 — Thu, 25 Sep 2025 13:32:44 GMT

I want to use a Intel EMA Server and the Intel vPro Clients from Dell with the Admin Control Mode.

For this usage i need certificates.

This is why i have following Questions:

How can i create Intel vPro Certificates with my own CA (Certificate Authority) which is running on a Windows Server and use these on the Intel EMA Server/Clients?

I have created a Template on the CA for this purpose so far, but the certificate request for this template is not showing up (a full instruction how to create the certificate would be helpful).

Does every Client need a Intel vPro Certificate and how does this work in connection with the Intel EMA Server?

How can i install the root hash certificates on the clients?

Re: Creating and using a Intel vPro Certificate mit own CA

Arun_Intel1 — Tue, 30 Sep 2025 17:56:41 GMT

Hi Fabian8,

Greetings!

We see that you are looking to create an Intel vPro Certificate with your own ca running on windows server and use these on the Intel EMA server clients.

Please find the details given below, regarding your query:

How can i create Intel vPro Certificates with my own CA (Certificate Authority) which is running on a Windows Server and use these on the Intel EMA Server/Clients?

I have created a Template on the CA for this purpose so far, but the certificate request for this template is not showing up (a full instruction how to create the certificate would be helpful).

Please find the article given below for reference:

https://www.intel.com/content/www/us/en/support/articles/000097538/software.html

Does every Client need a Intel vPro Certificate and how does this work in connection with the Intel EMA Server?

No, not every client (endpoint) needs to have the full Intel vPro certificate installed. Here's how it works:

Intel vPro provisioning requires a certificate hash to be present in the Intel Management Engine (ME) firmware of the endpoint.
This hash is used to validate the provisioning certificate during remote setup.
The actual certificate (typically from a trusted Certificate Authority like GoDaddy, DigiCert, etc.) is installed on the Intel EMA server, not on each endpoint.

How can i install the root hash certificates on the clients?

According to our research, We create the self-cert on the EMA server and We just need to upload the hash of the bundle cert created on the EMA server, however the self-cert only allows the provisioning, it does not work for remote provisioning, rather we would recommend you to purchase an AMT provisioning certificate from the Intel Authorized vendor (GoDaddy, DigiCert or Sectigo/Entrust) whose certificate hash has been added with in the AMT firmware of the Client machine.

How to Purchase and Install a DigiCert*, Sectigo*, or GoDaddy* Certificate for Intel® AMT Provisioning

https://www.intel.com/content/www/us/en/support/articles/000099677/software.html

https://www.intel.com/content/www/us/en/support/articles/000055009/technologies.html

Thanks & Regards

Arun

Intel Customer Support Technician

intel.com/vPro

Re: Creating and using a Intel vPro Certificate mit own CA

Fabian8 — Tue, 30 Sep 2025 13:06:04 GMT

Hi,

i have tried to use this Article which you have given as Reference (https://www.intel.com/content/www/us/en/support/articles/000097538/software.html) and now i have the Problem that, it is set up in Intel EMA but when CIRA doesn't connect to the INTEL AMT Device. It only works in Client Control Mode but when i switch it to Admin Control mode it doesn't work.

I have only done the steps which were given in the Article.

I think there must be done something additional this is why i am asking?

Re: Creating and using a Intel vPro Certificate mit own CA

Fabian8 — Tue, 30 Sep 2025 13:16:05 GMT

and also the client is not provisioning anymore when i try that

Re:Creating and using a Intel vPro Certificate mit own CA

vij1 — Tue, 30 Sep 2025 16:27:15 GMT

Hi Fabian,

Thank you for your response.

As you mentioned, the endpoint was not provisioned according to the recommended article. To help us investigate further, could you please provide the following details:

1. A screenshot of the General tab from the EMA WebUI Console.

2. A screenshot of the Desktop tab > Connect section — this will help us determine whether in-band communication is functioning correctly.

3. Run the Intel® EMA Configuration Tool (ECT) on the endpoint and share the logs with us. These logs will help us verify the ME (Management Engine) version, ME drivers, BIOS version, and understand why provisioning is failing.

Instructions to Run the ECT Tool:

· Download the tool from the following link: Intel® EMA Configuration Tool

· Installation:

o Download and unzip the tool.

o Double-click the .msi file and follow the installation prompts.

· Run the Tool:

o Open Command Prompt as Administrator (or use Windows PowerShell).

o Navigate to the installation folder (default: C:\Program Files (x86)\Intel\EMAConfigTool)

o Run the following command:

o EMAConfigTool.exe –verbose

Please share the requested screenshots and logs at your earliest convenience so we can proceed with troubleshooting.

Best regards,

Vijay Nalla

Intel Customer Support

Re: Re:Creating and using a Intel vPro Certificate mit own CA

Fabian8 — Thu, 02 Oct 2025 07:41:44 GMT

Hi,

here are the Screenshots you requested.

Re:Creating and using a Intel vPro Certificate mit own CA

Arun_Intel1 — Wed, 15 Oct 2025 18:39:36 GMT

Hi Fabian8,

Please feel free to revert for any further query as per our email conversation.

Thanks & Regards

Arun

Intel Customer Support Technician

intel.com/vPro