Intel vPro® Platform
Intel Manageability Forum for Intel® EMA, AMT, SCS & Manageability Commander
2878 Discussions

Invalid certificate

Stef_L
Beginner
1,953 Views

Hi,

I get issues trying to setup devices in host based provisioning mode.

Error "The remote certificate is invalid according to the validation procedure" always showing in EMALog-ManageabilityServer.txt:

============================

Failed host based provisioning : (TESTPC,825F801C).
Error:Unable to connect to a Swarm Server, user=SYSTEM : (TESTPC,825F801C).
Warning:Received stop remote configuration status from: 825F801C, status: INVALID_PT_MODE (3)
The remote certificate is invalid according to the validation procedure.
Message:Connecting to Swarm Server : (TESTPC,825F801C).
Message:Sending Agent Stop Remote Configuration Message : (TESTPC,825F801C).
Attempting phase 1 host based provisioning : (TESTPC,825F801C).

============================

Tested on two devices with AMT version 12.0.6  and 16.0.15.1662.
Devices are wired connected. Non firewall between them and EMA server.
EMA Server and agent updated to latest version 1.10.1.

Tried PKI provisioning with a certificate purchased from Entrust, same result.


What could be wrong?

As I understand, no PKI certificate is necessary in HPB mode, so which certificate is involved in the server logs?


Thank you.

0 Kudos
1 Solution
MIGUEL_C_Intel
Moderator
1,800 Views

Hello, Stef_L,


The Certificate is necessary for the Admin Control Mode (ACM), this option brings the opportunity to access the endpoint machine without the User-consent, access the BIOS (Out-of-Band), turn the system On and Off, and provision the machines remotely from the first time. 


Machines with Intel® vPRO come with pre-installed Certificate hashes in the BIOS firmware from the authorized Certificate vendors; this feature allows the validation of the Certificate and provisioning of the new machines.


Please review to EMA agent profile, maybe the settings were configured for Admin mode and EMA is asking for the Certificate.


In your original post, you got the error below:

Error: Unable to connect to a Swarm Server, user= SYSTEM: (TESTPC,825F801C).


Did you already install the EMA agent file to the endpoint?

Please perform the test below:

Open a command line as Administrator in the endpoint.

Go to the default path \c:\Program Files\Intel\Ema Agent\

Run the command: emaagent.exe -swarmserver

 

The test should resolve the FQDN and the port it is trying to connect to. 


I look forward to hearing from you.


Regards,

Miguel C.

Intel Customer Support Technician


View solution in original post

0 Kudos
5 Replies
ICIT
New Contributor I
1,929 Views

 

Are you doing HB setup to Client Control Mode or Admin Control Mode?

 

https://software.intel.com/sites/manageability/AMT_Implementation_and_Reference_Guide/WordDocuments/hostbasedsetupoptions.htm

 

Host-Based Setup to Admin Control Mode

0 Kudos
Stef_L
Beginner
1,861 Views

Hi,


I'm doing HB setup to client control mode within Intel EMA.
In that situation, I cannot choose a PKI certificate, so why EMA complaint about invalid certificate?


Thanks.

0 Kudos
MIGUEL_C_Intel
Moderator
1,801 Views

Hello, Stef_L,


The Certificate is necessary for the Admin Control Mode (ACM), this option brings the opportunity to access the endpoint machine without the User-consent, access the BIOS (Out-of-Band), turn the system On and Off, and provision the machines remotely from the first time. 


Machines with Intel® vPRO come with pre-installed Certificate hashes in the BIOS firmware from the authorized Certificate vendors; this feature allows the validation of the Certificate and provisioning of the new machines.


Please review to EMA agent profile, maybe the settings were configured for Admin mode and EMA is asking for the Certificate.


In your original post, you got the error below:

Error: Unable to connect to a Swarm Server, user= SYSTEM: (TESTPC,825F801C).


Did you already install the EMA agent file to the endpoint?

Please perform the test below:

Open a command line as Administrator in the endpoint.

Go to the default path \c:\Program Files\Intel\Ema Agent\

Run the command: emaagent.exe -swarmserver

 

The test should resolve the FQDN and the port it is trying to connect to. 


I look forward to hearing from you.


Regards,

Miguel C.

Intel Customer Support Technician


0 Kudos
Stef_L
Beginner
1,789 Views

Hi,

 

I've found de problem with swarm server.

Making some debugging on swarm server as you mentionned pointed me to the issue.

Splunk is installed on the EMA server for monitoring and is listening on port 8089, wich is a port also used by swarm server.

I stopped de Splunk service and everything is working now.

I'm able to provision AMT.

 

Thanks Miguel.

0 Kudos
MIGUEL_C_Intel
Moderator
1,781 Views

Hello, Stef_L,


I am glad to know EMA is working now.


Regarding the port issue for the Swarm Server.  Intel® EMA allows to change the port number for the Swarmserver.  Open the EMA web console with the Global account, in the settings tab you will see the option to change the Swarm server port. 


Regards,

Miguel C.

Intel Customer Support Technician


0 Kudos
Reply