vPRO remote configuration error

[eekyy]

Hi all!
My problem regards remote provisioning of intel vPRO desktops. I do have remote configuration certificate from verisign (it`s imported to personal certificate store of local machine as well as local user ) but when machine sends hellows scs throws such errors:

The SOAP connection with connection parameter set #1 failed: AMT Connection Error: SOAP Error [26]: "getFullCoreVersion: Fault: 'EOF was observed that violates the protocol. The client probably provided invalid authentication information.' : Details: 'SSL connect failed in tcp_connect()'".

The SOAP connection with connection parameter set #2 failed: AMT Connection Error: SOAP Error [26]: "getFullCoreVersion: Fault: 'Error observed by underlying BIO: Bad file descriptor' : Details: 'SSL connect failed in tcp_connect()'".

I tried with my own generated remote certificate as well, I did suplly hash through MEBx and the same errors apear.

Any help would be very much appreciated, because I`m struggling with it almost 2 weeks. Thanks in advance.

[Andrew_S_Intel2]

Hi eekyy. Could you give a little more detail on what version of AMT the vPro systems have? If you're not sure, you can tell me the model of the computer and I can figure it out.

Also could you say what version of SCS you are working with? Or are you using a different mechanism to provision?

Finally, were there any messages before those two errors? Or did you say those immediately after the hello packet from the vPro systems showed in the logs?

[eekyy]

Hi Andrew, I`m working with 3.2.2 and 3.2.1 AMT systems and my scs version is 5.1.0.50. I`m using Client management suite form symantec. Messages are in that order:

SeverityError,Proper certificate that matches the pre loaded certificate was not found in the user certificate store. PKI configuration failed

SeverityError,Error Configuring Intel AMT device: Failed to connect to un-configured Intel AMT device at IP 10.10.10.81: Proper certificate that matches the pre loaded certificate was not found in the user certificate store. PKI configuration failed

Debug,The SOAP connection with connection parameter set #1 failed: AMT Connection Error: SOAP Error [26]: "getFullCoreVersion: Fault: 'EOF was observed that violates the protocol. The client probably provided invalid authentication information.' : Details: 'SSL connect failed in tcp_connect()'"

Debug,The SOAP connection with connection parameter set #1 failed: AMT Connection Error: SOAP Error [26]: "getFullCoreVersion: Fault: 'Error observed by underlying BIO: Bad file descriptor' : Details: 'SSL connect failed in tcp_connect()'"

Debug,Configuring Intel AMT device started.,VPROLAB\administrator,2200,4C4C4544-004C-4710-8056-C3C04F34334A

Information,Configuring Intel AMT device.,VPROLAB\administrator,865,4C4C4544-004C-4710-8056-C3C04F34334A

Debug,Incoming connection from 10.10.10.81:16994. version 3. count 1. UUID 4C4C4544004C47108056C3C04F34334A

[Andrew_S_Intel2]

On the good side, the SCS is clearly getting the messages from the AMT system, but it looks like there's some issue coming up with the cert you have for provisioning or how it's installed. I'm following up with some questions internally, in the mean time here's some resources that might be helpful.

Section III of this is probably the most useful, it describes some of the details around the CN field of the certificate that can potentially cause issues (since you're working with 3.2 systems, you have some more options here).
http://www.vproexpert.com/59JHE//RCGF-Cert-Util/docs/RemoteConfigurationCertificateSelection_v1.pdf

Given that you're working with a symantec solution, this could also be helpful:
http://www.symantec.com/connect/articles/remote-configuration-certificate-application-best-practices-intel-vpro-systems