All posts tagged InTune

Strong Certificate Mapping Error with PKCS

Microsoft recently announced support for strong certificate mapping for certificates Intune PKCS and SCEP certificates. Administrators are encouraged to update their Intune Certificate Connector servers and SCEP device configuration policies to support this capability as soon as possible.

PKCS

Organizations that use PKCS device configuration policies to deploy certificates to Intune-managed endpoints may have encountered the following error message in the event log on the Intune Certificate Connector server.

System.NullReferenceException: CertEnroll::CX509Extension::Initialize: Invalid pointer 0x80004003 (-2147467261 E_POINTER) at CERTENROLLLib.IX509Extension.Initialize(CObjectId pObjectId, EncodingType Encoding, String strEncodedData)

Known Issue

The above error is a known issue that has been resolved with the November security updates. If you encounter this error, install the latest Microsoft security update from November 2024.

Additional Information

Strong Certificate Mapping for Intune PKCS and SCEP Certificates

Intune Strong Certificate Mapping Error

Leave a comment
by Richard M. Hicks on November 18, 2024  •  Permalink
Posted in Active Directory Certificate Services, Certificate Authentication, Certificate Authority, Certificate Connector for Intune, Certificate Services, Certificate-Based Authentication, certificates, InTune, Intune Certificate Connector, Intune PFX Connector, Microsoft, Microsoft Endpoint Manager, Microsoft Intune, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2025
Tagged , , , , , , , , ,

Posted by Richard M. Hicks on November 18, 2024

https://directaccess.richardhicks.com/2024/11/18/strong-certificate-mapping-error-with-pkcs/

Delete A Cloud PKI for Intune Certificate Authority

Deleting an Always On VPN Device Tunnel

When Microsoft first introduced Cloud PKI for Intune, the solution did not allow administrators to delete a CA after it was created. As you are limited to just six Cloud PKI for Intune CAs, this was quite frustrating, especially during the testing and evaluation phase, where you may need to spin up a few instances before you decide on the features you need.

Are you interested in learning more about Cloud PKI for Intune? Register for my upcoming online training course, Mastering Certificates with Microsoft Intune. This three-day comprehensive, deep-dive course covers all aspects of issuing and managing certificates with Intune, including provisioning and managing Cloud PKI for Intune. Click here to learn more.

Delete Cloud PKI

Thankfully, Microsoft eventually realized this shortcoming and added this much needed feature a few months ago. However, removing an Intune Cloud PKI CA requires administrators to follow some specific steps to remove a CA successfully. Since Cloud PKI for Intune uses a two-tier deployment model, administrators must remove the issuing CA first and then the root CA if required.

Issuing CA

Follow the steps below to delete a Cloud PKI for Intune issuing CA.

Intune Policies

Be sure to delete any Intune device configuration policies relating to Cloud PKI for Intune before decommissioning a Cloud PKI for Intune CA. This includes trusted certificate policies, Wi-Fi policies, and VPN policies.

Pause CA

The first step of deleting a Cloud PKI for Intune CA is to pause the service. Pausing the service prevents new certificates from being issued while the administrator completes the remaining retirement tasks. Open the Intune portal (https://intune.microsoft.com), navigate to Tenant Administration > Cloud PKI, and click the CA to be deleted. Next, click Pause to pause the CA.

Revoke Certificates

Administrators must revoke all issued certificates before deleting the issuing CA. Click on any issued certificate to view its properties and then click the Revoke button, as shown here.

Complete this step for each certificate issued and active on the CA.

Note: It takes some time before the certificate status shows Revoked in the management console. Be patient!

Revoke CA Certificate

Once the administrator has revoked all issued certificates, click Revoke to revoke the issuing CA’s certificate.

Delete CA

Once the issuing CA certificate has been revoked the administrator will now have the option to delete the Cloud PKI for Intune issuing CA.

Root CA

After the administrator deletes the issuing CA, the root CA can be removed if necessary. Click on the root CA and click the Delete button.

Additional Information

Delete Microsoft Cloud PKI Certification Authority

Strong Certificate Mapping for Intune PKCS and SCEP Certificates

Microsoft Cloud PKI for Intune and Certificate Templates

Microsoft Cloud PKI for Intune and Active Directory

Microsoft Cloud PKI for Intune SCEP URL

Microsoft Cloud PKI for Intune on RunAs Radio

Leave a comment
by Richard M. Hicks on November 11, 2024  •  Permalink
Posted in authentication, Azure Active Directory, Azure AD, Certificate Authentication, Certificate Authority, Certificate Services, certificates, cloud, Cloud PKI, Cloud Service, Endpoint Manager, Enterprise, Infrastructure, InTune, MDM, MEM, Microsoft, Microsoft Endpoint Manager, Microsoft Intune, Mobile Device Management, Operational Support, PKCS, PKI, public cloud, public key infrastructure, SCEP, Security, Simple Certificate Enrollment Protocol, systems management, Windows 10, Windows 11
Tagged , , , , , , , , , , , , , , , ,

Posted by Richard M. Hicks on November 11, 2024

https://directaccess.richardhicks.com/2024/11/11/delete-a-cloud-pki-for-intune-certificate-authority/

Intune Strong Certificate Mapping Error

Microsoft recently introduced support for strong certificate mapping in Intune to support changes introduced with the May 2022 security update KB5014754. Specifically, Intune now supports adding the SID for the principal in the subject name to the certificate for PKCS and SCEP device configuration policies.

Error

A few folks have contacted me about an error they encountered when configuring strong certificate mapping for Intune device configuration profiles using PKCS. Specifically, they would receive the following error message after specifying the URI value {{OnPremisesSecurityIdentifier}} in the Subject Alternative Name section of the PKCS policy.

“A value is required for Value. Value can include allowed variables combined with static text. UPN and Email address should include an @, for example: “{{AAD_Device_ID}}@contoso.com”. DNS cannot end with a symbol or contain an @ sign, e.g. “{{DeviceName}}.contoso.com“ or “{{DeviceName}}”. See support variables here: https://go.microsoft.com/fwlink/?linkid=2104597“

Resolution

Administrators will receive this message when adding the {{OnPremisesSecurityIdentifier}} variable to a PKCS device configuration policy. This error is expected because PKCS does not require (or support) the use of this value in this field. The {{OnPremisesSecurityIdentifier}} value is only required for SCEP Intune device configuration profiles.

To add the SID to a PKCS certificate, administrators must only define a registry value on the Intune Certificate Connector server as described here. No changes are required on the PKCS device configuration policy in Intune.

Additional Information

Strong Certificate Mapping for Intune PKCS and SCEP Certificates

Certificate-Based Authentication Changes for Always On VPN

Leave a comment
by Richard M. Hicks on November 8, 2024  •  Permalink
Posted in Active Directory, Active Directory Certificate Services, AD CS, administration, authentication, Certificate Authentication, Certificate Authority, Certificate Connector for Intune, Certificate Services, Certificate-Based Authentication, certificates, Endpoint Manager, Enterprise, enterprise mobility, Infrastructure, InTune, Intune Certificate Connector, Intune PFX Connector, MDM, MEM, Microsoft, Microsoft Endpoint Manager, Microsoft Intune, Mobile Device Management, Mobility, PFX Connector, PKCS, PKI, SCEP, Simple Certificate Enrollment Protocol, troubleshooting
Tagged , , , , , , , , , , , , , , , ,

Posted by Richard M. Hicks on November 8, 2024

https://directaccess.richardhicks.com/2024/11/08/intune-strong-certificate-mapping-error/

« Older Posts