Using Public Certificates With SCOM Part 3

In Part 1 and Part 2 of this series, I have explained how to configure your SCOM servers to accept manual agent installations and also how to manually install these agents onto your untrusted servers and clients.

In this part of the series, I will demonstrate what is needed to create a custom Certificate Template that will be used to create the Certificate Request to the Public 3rd Party Certificate Authority (this Certificate Template could also be used for an Internal CA too) and I will also go through the process of bringing the newly issued certificate into SCOM.

Certificate Request Process for SCOM RMS / MS and Untrusted Servers / Clients

First up, logon to your SCOM server as an Administrator, open Notepad and copy the text below into a new page and save it onto the root of the C drive of the server as a .INF file named something similar to catemplate.inf

[Version]

Signature= "$Windows NT$"

[NewRequest]

Subject = "CN=YourFullComputerNameHere,OU=MyOU,O=MyOrg,L=MyCity,S=MyState,C=US"

KeySpec= 1

KeyLength = 2048

KeyUsage = 0xa0

ProviderName = "Microsoft RSA Schannel Cryptographic Provider"

ProviderType = 12

RequestType = PKCS10

Exportable = TRUE

MachineKeySet = TRUE

UseExistingKeySet = FALSE

[EnhancedKeyUsageExtension]

OID = 1.3.6.1.5.5.7.3.1

OID = 1.3.6.1.5.5.7.3.2

Change my text in RED ITALICS to your actual computer name making sure that you specify the ‘Full Computer Name’ of your server or computer. This name could be simply a NETBIOS name or an FQDN.
(This is a crucial setting to note as it is going to be used again later on in determining the Certificate Subject Name.)

To get the exact full computer name of the server you are working on, follow this simple procedure:

Windows Server 2003

Click Start, Click Run, type ‘sysdm.cpl’ (without the quotations)

Go to the ‘Computer Name’ tab and take a note of the full computer name

Windows Server 2008

Click Start, Click on ‘Search Programs and Files’, type ‘sysdm.cpl’ (without the quotations)

From the ‘Computer Name’ tab, take a note of the full computer name

Now, open up a command prompt ensuring you select ‘Run As Administrator’ so you have the proper permissions to continue

Type cd\ and press ‘Enter’ to take you back to the root of the C drive

Type the following to create the certificate request using the catemplate.inf file that we created earlier:

certreq –new c:\catemplate.inf mycert.req

This will create a file on the root of your C drive called ‘mycert.req’. This file will now need to be sent to your external CA provider to create a new externally secured trusted certificate with the subject name of the certificate being the same as the ‘Full Computer Name’ of your server

Once you have the certificate back from the external CA, copy it to the root of the C drive so the certificate template, request file and issued certificate are all in the same location

(I have found that although this seems irrelevant, if these files are not in the same location, sometimes the next step doesn’t work!)

Open back up your command prompt ensuring again that you ‘Run As Administrator’

Type the following to install the certificate into the Local Computers Personal Certificate Store, substituting the certificate name below with the full name and extension of your newly issued certificate, then press ‘Enter’ to accept the certificate:

certreq -accept mynewlyissuedcertificate.cer

Now, you need to use the command prompt to browse to the ‘MOMCertImport.exe’ utility on the SCOM installation media (make sure you browse to the correct architecture folder i.e. AMD64 or i386) and using the /subjectname switch you need to specify the certificate name exactly as you see it (substituting my.fullcomputername.com in the example below) when you open up the ‘Certificates’ MMC snapin and select the ‘Local Computer’ option.

From the 'Local Computer Certificates' MMC, you need to browse to the ‘Personal\Certificates’ subfolder to see (and make a note of) the full name of the certificate that you would have imported using the certreq utility earlier.

Your command should look something similar to this:

MOMCertImport.exe /subjectname my.fullcomputername.com

Make sure that this process is repeated on all SCOM RMS/MS and untrusted server and clients.

Once the above commands have been carried out on all SCOM and untrusted servers and clients, it is a good idea to restart the Health Service on the untrusted clients first and then if needed, you will need to restart the Health Service on the SCOM RMS/MS servers too.

Restarting the Health Service will then kick-start the Agent discovery and authentication and if all is configured the way it should be, then you will see your untrusted server show up in the 'Pending Management' section of the 'Administration' tab within the SCOM Console Wunderbar.

From here and once you see your server listed, simply click on the 'Approve' option in the 'Actions' window on the right hand side to complete the final step to bring your untrusted server into your SCOM monitoring environment.