Creating and using a Intel vPro Certificate mit own CA

[Fabian8]

I want to use a Intel EMA Server and the Intel vPro Clients from Dell with the Admin Control Mode.

For this usage i need certificates.

This is why i have following Questions:

How can i create Intel vPro Certificates with my own CA (Certificate Authority) which is running on a Windows Server and use these on the Intel EMA Server/Clients?

I have created a Template on the CA for this purpose so far, but the certificate request for this template is not showing up (a full instruction how to create the certificate would be helpful).

Does every Client need a Intel vPro Certificate and how does this work in connection with the Intel EMA Server?

How can i install the root hash certificates on the clients?

[Arun_Intel1]

Hi Fabian8,

Greetings!

We see that you are looking to create an Intel vPro Certificate with your own ca running on windows server and use these on the Intel EMA server clients.

Please find the details given below, regarding your query: 

How can i create Intel vPro Certificates with my own CA (Certificate Authority) which is running on a Windows Server and use these on the Intel EMA Server/Clients?

I have created a Template on the CA for this purpose so far, but the certificate request for this template is not showing up (a full instruction how to create the certificate would be helpful).

Please find the article given below for reference:

https://www.intel.com/content/www/us/en/support/articles/000097538/software.html

Does every Client need a Intel vPro Certificate and how does this work in connection with the Intel EMA Server?

Yes, the client needs an Intel vPro certificate (Recommended an AMT provisioning certificate) purchased from the Intel Authorized vendor (GoDaddy, DigiCert or Sectigo/Entrust) whose certificate hash has been added with in the AMT firmware of the Client machine.

How can i install the root hash certificates on the clients?

According to our research, We create the self-cert on the EMA server and We just need to upload the hash of the bundle cert created on the EMA server, however the self-cert only allows the provisioning, it does not work for remote provisioning, rather we would recommend you to purchase an AMT provisioning certificate from the Intel Authorized vendor (GoDaddy, DigiCert or Sectigo/Entrust) whose certificate hash has been added with in the AMT firmware of the Client machine.

How to Purchase and Install a DigiCert*, Sectigo*, or GoDaddy* Certificate for Intel® AMT Provisioning

https://www.intel.com/content/www/us/en/support/articles/000099677/software.html

https://www.intel.com/content/www/us/en/support/articles/000055009/technologies.html

Thanks & Regards

Arun

Intel Customer Support Technician

intel.com/vPro

[Fabian8]

Hi,

i have tried to use this Article which you have given as Reference (https://www.intel.com/content/www/us/en/support/articles/000097538/software.html) and now i have the Problem that, it is set up in Intel EMA but when CIRA doesn't connect to the INTEL AMT Device. It only works in Client Control Mode but when i switch it to Admin Control mode it doesn't work.

I have only done the steps which were given in the Article.

I think there must be done something additional this is why i am asking?

[Fabian8]

and also the client is not provisioning anymore when i try that

[vij1]

Hi Fabian,

Thank you for your response.

As you mentioned, the endpoint was not provisioned according to the recommended article. To help us investigate further, could you please provide the following details:

1.     A screenshot of the General tab from the EMA WebUI Console.

2.     A screenshot of the Desktop tab > Connect section — this will help us determine whether in-band communication is functioning correctly.

3.     Run the Intel® EMA Configuration Tool (ECT) on the endpoint and share the logs with us. These logs will help us verify the ME (Management Engine) version, ME drivers, BIOS version, and understand why provisioning is failing.

Instructions to Run the ECT Tool:

·       Download the tool from the following link: Intel® EMA Configuration Tool

·       Installation:

o  Download and unzip the tool.

o  Double-click the .msi file and follow the installation prompts.

·       Run the Tool:

o  Open Command Prompt as Administrator (or use Windows PowerShell).

o  Navigate to the installation folder (default: C:\Program Files (x86)\Intel\EMAConfigTool)

o  Run the following command:

o  EMAConfigTool.exe –verbose

Please share the requested screenshots and logs at your earliest convenience so we can proceed with troubleshooting.

Best regards,

Vijay Nalla

Intel Customer Support