- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi All,
The TLS certificate that I was using in my configuration expired. It was then renewed but not when connecting to clients it shows as invalid but still connects. When you download the certificate it has the new expiry dated. I have tried un-configuring and re-configuring the client but it made no difference. I tried creating a new profile and configuring with that. I also tried running a maintenance task on one of the clients. any suggestions on what to do next? create a new certificate and reconfigure all machines?
Cheers,
Ross
Link Copied
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello rjardine,
Thanks for joining the community.
As part of the research process we will need you to attach the following information:
1. Screen shot of the certificate, specifically the values under Enhanced Key Usage.
2. Screen shot of theCertificate's Certification path
3. Screen shot of the RCSService in services. Include the account the service is running as.
4. Need a copy of the RCSLog.log file from the RCS server.
5. Confirmation that the certificate is in the personal certificate store of the account running the RCSServer service.
We will look forward for your updates.
Regards.
Jose A.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Jose,
Thanks for the reply. I have included my responses to your questions below.
1. Screen shot of the certificate, specifically the values under Enhanced Key Usage.
2. Screen shot of theCertificate's Certification path
3. Screen shot of the RCSService in services. Include the account the service is running as.
4. Need a copy of the RCSLog.log file from the RCS server.
(see attached)
5. Confirmation that the certificate is in the personal certificate store of the account running the RCSServer service.
(As Per Question 3 Screenshot)
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Jose,
Thanks for the reply. I have included my responses to your questions below.
1. Screen shot of the certificate, specifically the values under Enhanced Key Usage.
2. Screen shot of theCertificate's Certification path
3. Screen shot of the RCSService in services. Include the account the service is running as.
4. Need a copy of the RCSLog.log file from the RCS server.
(see attached)
5. Confirmation that the certificate is in the personal certificate store of the account running the RCSServer service.
(As Per Question 3 Screenshot)
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Jose,
Thanks for the quick reply. Please see my responses below.
1. Screen shot of the certificate, specifically the values under Enhanced Key Usage.
2. Screen shot of theCertificate's Certification path
3. Screen shot of the RCSService in services. Include the account the service is running as.
4. Need a copy of the RCSLog.log file from the RCS server.
(see attached)
5. Confirmation that the certificate is in the personal certificate store of the account running the RCSServer service.
(Included in Question 3)
Many thanks,
Ross
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello rjardine,
Thanks for the information provided.
Please try any of the following methods:
There are four ways to fix the expired TLS certificate issue.
The first two methods are run on the Intel® Setup and Configuration Software (Intel® SCS) server through RCS:
- ACUConfig MaintainViaRCSOnly RCSServer ProfileName AutoMaintain [/AdminPassword password ] {[/WMIUser username] [/WMIUserPassword password]}
- ACUConfig MaintainViaRCSOnly RCSServer ProfileName ReissueCertificates [/AdminPassword password] {[/WMIUser username] [/WMIUserPassword password]}
- ACUConfig MaintainAMT fileName.xml AutoMaintain [/AdminPassword password] [/DecryptionPasswordpassword]
- ACUConfig MaintainAMT fileName.xml ReissueCertificates [/AdminPassword password] [/DecryptionPassword password]
Let me know if any of these helps.
Jose A.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello rjardine,
Do you have any updates, questions or comments in regards to this issue?
Please do not hesitate to contact us back.
If you consider the issue to be completed please let us know so we can proceed to mark this thread as resolved.
Regards
Jose A.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Jose,
I tried the methods from the RCS Server but I had no success, a lot of the systems failed to perform the maintenance. Even with the systems that reports as successfully doing maintenance they still show the certificate error. We have 2 profiles for two domains with slightly different configs, resorting to ACUConfig might be very complex. Also I setup a Get discovery Data task and this has been running for days and only slowly going up.
SCS Console View:
Error from Maintenance Task:
Regards,
Ross Jardine
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello rjardine,
Regret to hear about there is no progress. We will investigate further and will update you soon.
Regards
Jose A.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello rjardine,
By any chance have you recently issued a new root or intermediate certificate? Did the RCS server got those updates?
Regards
Jose A.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello rjardine,
Do you have any updates, questions or comments in regards to this issue?
Please do not hesitate to contact us back.
If you consider the issue to be completed please let us know so we can proceed to mark this thread as resolved.
Regards
Jose A.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Jose,
Sorry I have been on vacation for a short while.
I am still trying to get to the bottom of this issue.
It appears our Domain Controller certificates where renew about 2 months ago. I am making some esquires about this.
I have tried running the maintenance tasks with acuconfig and have attached the logs. I have managed to create collections in Configuration Manager to identify which machines are running which profiles. So I can target the different groups of machines if i can get it working.
Regards,
Ross Jardine
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello rjardine,
Thanks for the updates.
We will take a look at your logs and will let you know what we find.
Jose A.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello rjardine,
After looking at the maintenances logs that you attached I just found a line with an error:
Thread:6540(ERROR) : BB8XRC2.ltu.edu.au, Category: EnumerateNetworkInterfaces bad catch Source: vProConfigurationInternal.cpp : vProConfigurationNamespace::vProConfigurationInternal::EnumerateNetworkInterfaces Line: 6202:
Do you know what is this address BB8XRC2.ltu.edu.au for?
One suggestion is to please follow the section 5.10 page 111 of the following document: https://www.intel.com/content/dam/support/us/en/documents/software/Intel_SCS_User_Guide.pdf https://www.intel.com/content/dam/support/us/en/documents/software/Intel_SCS_User_Guide.pdf# page=118
Please let me know your updates.
Jose A.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello rjardine,
Do you have any updates, questions or comments in regards to this issue?
Please do not hesitate to contact us back.
If you consider the issue to be completed please let us know so we can proceed to mark this thread as resolved.
Regards
Jose A.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello rjardine,
We will proceed to mark this thread as resolved. If you have further issues or questions just go ahead and create a new topic.
Jose A.
![](/skins/images/C4F7392A5C68ACA60290C9576F107044/responsive_peak/images/icon_anonymous_message.png)
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page