This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(96, 36%, 19%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPB%3C/text%3E%3C/svg%3E)
Hi all, We initially setup our SCCM environemnt using HTTP but now decided to flip to PKI to support CMG. We only have 1 MP which is on the Primary site as well. I have switched over MP, DP and SUP to use HTTPS, also binded MP 443 port to the IIS cert I have generated. I have also switched site Communication tab to use PKI. Finally, I have pushed client auth cert through GPO and can see clients are getting certs on Personal Store. I can even see the clients switching over to PKI under SCCM client General Tab. Also verified client registered using PKI in ClientIDManagerStartup.log. My problem is when I go check Devices in SCCM Console, under client certificate, they still show as self-signed rather than PKI. Thoughts please...
It seems there is no update for a couple of days. May we know the current status of the problem? If you think Jason's reply is useful, you may accept it as answer.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(208, 63%, 30%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EP%3C/text%3E%3C/svg%3E)
I am having the same issue.
on client side it is showing that it is using PKI but when I go to check in sccm console it is showing as self signed.
Can anyone give me the exact cause and solution of this???
As has been called out, this is (still) a bug in ConfigMgr. If you are impacted, please use the in console feedback system to submit a frown.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(195.2, 5%, 28%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJG%3C/text%3E%3C/svg%3E)
Wasted most of a day trying to figure out why the console wasn't updating. So we can't trust the console client cert column or the HTTPS reports. After years you'd think this would have been addressed. I suppose now we need to use an unsecure FSP to tell us if HTTPS is working or not to make our sites more secure. :|
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(198.4, 60%, 29%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ENO%3C/text%3E%3C/svg%3E)
issue was resolved in version 2503. 2309 had the same problem but when upgraded to 2503 it started to show properly
Yes, I know this is still an issue. I have no control over whether this issue is addressed, however, because of the way we now store certs, addressing the issue is non-trivial.
Why is this irritating and what challenge or problem is it causing you (besides not knowing), i.e., what's the impact on your org?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(214.4, 77%, 30%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJA%3C/text%3E%3C/svg%3E)
I find it irritating because it seems so simple but having incorrect information in the console shouldn't be acceptable. Yes, I can go to the device and check it. But I have thousands of devices and it would be nice to know PKI is functioning properly from the console view.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(265.6, 78%, 35%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMC%3C/text%3E%3C/svg%3E)
Plus 1 from my side
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(310.4, 3%, 40%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ECD%3C/text%3E%3C/svg%3E)
Hi Jason
Is there a way get sccm client PKI certificate status via PowerShell or Command prompt, so that we can run a script in each client machines remotely and find the PKI status then outcome for all the clients write into a central logfile.
So, please share any commands or scripts you know about this
Thanks
Chad
Note that this has been addressed in TP2305 and I believe should be included in 2309.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(60.8, 27%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMB%3C/text%3E%3C/svg%3E)
I have confirmed on two different sites running 2309 that the issue is resolved. Clients are correctly reporting their client certificate as PKI.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(0, 53%, 10%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJA%3C/text%3E%3C/svg%3E)
I agree, 2309 now shows PKI at least with the console view when looking at all devices. Interestingly though I have a separate query for a collection result that I use to give me devices meeting a particular client level and it shows "Self-Signed" still for the client certificate when I add that column in the results.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(102.4, 35%, 19%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ECF%3C/text%3E%3C/svg%3E)
I still hope this issue will be sorted in next version of CM - which will already require "HTTPS only" (or Enhanced). If there is no valid info, it would be better to disable that column completely in console GUI. I took me good few hours to find out it is a bug in Console and no mistake in my environment... For time being there is readiness report for basic help: https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/preparing-for-https-only/ba-p/884761
Please submit this as feedback in the console using the file a frown functionality.
I have reported this bug to the ConfigMgr Product team. They are looking into this issue.
Thank you a lot. Your help is appreciated again.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(89.60000000000001, 74%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBR%3C/text%3E%3C/svg%3E)
Hello @Jason Sandys , today I've just upgraded my ConfigMgr to the latest version 2211 and the issue is still present. No biggie, just want to let you all know. Cheers.
The issue has been resolved with TP 2305 and I expect this to be resolved in the next current branch update - https://techcommunity.microsoft.com/t5/configuration-manager-blog/configuration-manager-technical-preview-version-2305/ba-p/3832110
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(316.8, 70%, 40%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESS%3C/text%3E%3C/svg%3E)
Running version 2207 and it took me a few hours to realize that this is a bug and not a configuration issue on my side :(
I just send a frown from within the console and hope that this will be fixed soon... Had to point a customer to this article to convince a customer that our change to HTTPS (PKI) has been successful and this is just a MS bug...
The issue has been resolved with TP 2305 and I expect this to be resolved in the next current branch update - https://techcommunity.microsoft.com/t5/configuration-manager-blog/configuration-manager-technical-preview-version-2305/ba-p/3832110
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(265.6, 70%, 35%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMK%3C/text%3E%3C/svg%3E)
I also have problem.