Hello everyone, today we have a post from Intune Sr. Support Escalation Engineer and certificate expert Anzio Breeze. In this post, Anzio goes through the entire process of setting up the PKCS certificate infrastructure and assigning PFX certificates to Intune client devices, including detailed insight into the happenings under the covers and tips for troubleshooting should you encounter any issues. Whether you’ve already implemented PKCS or you’re just thinking about it, this post is one you’ll want to read and bookmark. ===== With Microsoft Intune, you can easily give your users access to corporate resources through VPN, Wi-Fi or email profiles, and by authenticating these connections with certificates your end users don't have to enter their user names and passwords when making a connection. You can use Intune to assign these certificates to devices you manage and two types are supported: Simple Certificate Enrollment Protocol (SCEP) PKCS#12 (or PFX) Each certificate type has its own prerequisites and infrastructure requirements, and in this article I walk through everything you need to get PKCS certificates configured in your environment and assigned to you users. What is PFX / PKCS? PFX is a file format used for storing encrypted objects in a single file. Typically you will see a private key and its X.509 certificate stored together (this could include the certificate chain). PKCS stands for “Public Key Cryptography Standards” and it was created by RSA Security LLC in the 1990s. Intune supports the use of private and public key pair (PKCS) certificates and includes built-in settings to use these certificates for access and authentication to your organization’s resources. Certificates authenticate and secure access to your corporate resources, like a VPN or a WiFi network, and are deployed to devices using device configuration profiles. Requirements To use PKCS certificates with Intune, you'll need the following infrastructure: Active Directory domain: All servers listed in this section must be joined to your Active Directory (AD) domain. Certification Authority: An Enterprise Certification Authority (CA). Intune requires you to run AD Certificate Services (AD CS) with an Enterprise CA, not a standalone CA. A client: To connect to the Enterprise CA. Root certificate: An exported copy of your root certificate from your Enterprise CA. Intune Certificate Connector (also called the NDES Certificate Connector) Configuration Configuring and deploying PKCS certificates can be broken down into three main tasks. Note that this assumes you have already installed the Enterprise CA. Task A: Configuring certificate templates on the certification authority Task B: Installing and configuring the Intune Certificate Connector Task C: Creating and deploying a Trusted Root CA certificate profile and a PKCS #12 (.PFX) profile I go through each of these individually, then we’ll take a look at the end user experience, talk about some of the log files used and cover a few troubleshooting tips. Task A: Configuring certificate templates on the certification authority 1. On the issuing CA, use the Certificate Templates snap-in to create a new custom template, or copy an existing template (like the User template) and then edit it for use with PFX deployment. The key here is that the template must have the following configuration: - Specify a friendly Template display name for the template: - Make sure that Compatibility Settings are configured as shown below. - On the Subject Name tab, select Supply in the request: - On the Extensions tab, ensure Description of Application Policies includes Client Authentication and any other usage you require. - On the Request Handling tab, Purpose should be Signature and Encryption. Also, Allow private key to be exported must be enabled for certificate deployments to work. - On the Security tab, make sure SYSTEM has the permissions shown below: - Add the computer account for the computer where the Intune Certificate Connector is going to be installed: 2. Now we need to use the Certification Authority snap-in on the issuing CA to publish the certificate template. - Start by selecting the Certificate Templates node, then click Action -> New -> Certificate Template to Issue and select the template we just created. - Verify the template published by viewing it under the Certificate Templates folder: - On the CA computer, make sure that the computer that will host the Intune Certificate Connector has enroll permission so that it can access the template used in creating the .PFX profile. Do that by setting the permissions on the Security tab of the CA computer properties as shown below: NOTE: To revoke certificates the Service Account (SYSTEM) needs Issue and Manage Certificates rights for each certificate template used by a certificate profile. Installing and configuring the Intune Certificate Connector 1. Open the Microsoft Endpoint Management admin center, and then click Intune -> Device Configuration -> Certification Connectors -> Add -> Download Certificate Connector. 2. After the download completes, run the downloaded installer (ndesconnectorssetup.exe) as administrator. For .PFX certificates, be sure to run the installer on a computer that is able to connect to the Certification Authority. Choose the .PFX Distribution option then click Install and configure the rest of settings in the wizard. 3. Sign-in when the Connector UI opens. It’s important that you use a Global Admin for the tenant and it needs to have an Intune license or the sign-in will fail. 4. Open a command prompt and run services.msc, then right-click the Intune Connector Service and click Restart. Task C – Creating and deploying a Trusted Root CA certificate profile and a PKCS #12 (.PFX) profile 1. Export the Trusted Root CA certificate from the issuing CA as a .cer file. You do not export the private key. You will import this certificate when you configure a Trusted CA certificate profile. 2. Create a Trusted Certificate profile. Here’s an example of an Android Root profile: Here’s an example of an iOS Root profile: 3. Create a .PFX certificate profile. Here’s an example of an Android PFX profile: Here’s an example of an iOS PFX profile: Notes: 1. For Certification Authority, specify the internal FQDN of the certificate authority computer (e.g. Server1.domain.local) 2. For Certification Authority Name, specify the certificate authority name as displayed in the certification authority MMC. Look under Certification Authority (Local) To be sure of this information you can run this cmdlet on the CA as demonstrated below: certutil -config - -ping 4. With our profiles created, we now need to assign them to our groups. From the Intune portal, start by going to Device Configuration-> Profiles. 5. Select the profile you want to assign and choose Assignments. Include or exclude the groups of your choosing. Note that when you select a group you're choosing an Azure AD group, and to select multiple groups just hold down the Ctrlkey while making your selections. When done, be sure to save your changes. Below are example screen shots for Android. Android Trusted Root profile: Android PFX profile: iOS Trusted Root profile: iOS PFX profile: This completes the configuration and assignment of the profiles. Once the profiles reach the assigned devices they will request and receive a Trusted Root CA certificate and a PFX certificate. Here’s a simple look at what the overall process looks like: Admin creates a PFX certificate profile Intune Service request the On-Prem Intune Certificate Connector to create a new certificate for the user On-Prem Intune Certificate Connector sends PFX Blob and Request to On-Prem MS Certificate Authority On-Prem MS Certificate Authority issues and sends the PFX User Certificate back to the On-Prem Intune Certificate Connector On-Prem Intune Certificate Connector uploads the encrypted PFX User Certificate to Intune Intune decrypts the PFX User Certificate and re-encrypts for the device using the Device Management Certificate. Sends the PFX User Certificate to the Device. The certificate status is reported back to Intune The end user experience and log files used First we’ll take a look at Android. Note that these screen shots were taken from a non-KNOX device. You can also use a tool like My Certificates from the Google Play store to view them. Here’s what that looks like: Android Log Files Company Portal (OMADMLOG) from the device svclog from the Intune Certificate Connector computer. By default this is found under C:\Program Files\Microsoft Intune\NDESConnectorSvc\Logs\Logs. I typically like to use a tool like cmtrace from the Configuration Manager Toolkit to analyze the OMADMLOG logs. This allows you to use filter options to see specific activity in the log. I start by using “Certmgr” as the filter value to the see the specific data. Below I highlighted some key items to look for in the OMADMLog to validate that the ROOT and PFX certificates are successfully processing on the device. OMADMLog_0.log 2019-04-11T21:18:31.0290000 INFO com.microsoft.omadm.platforms.android.certmgr.state.NativeRootCertInstallStateMachine 8380 00588 Root cert '17CECEA1D337FAA7D167AD83A8CC7A8FCBF95C69' state changed from CERT_INSTALL_REQUESTED to CERT_INSTALL_REQUESTED 2019-04-11T21:18:31.2370000 INFO com.microsoft.omadm.platforms.android.certmgr.PfxCertificateManager 8380 00588 Found [le-PFXTemplate-6a881fa5-0866-4430-9cc1-f887e816953c] alias, IsCert: [false], IsKey: [true] 2019-04-11T21:18:31.3150000 INFO com.microsoft.omadm.platforms.android.certmgr.state.NativeScepCertInstallStateMachine 8380 00588 SCEP cert 'E67A52B1-430D-4CD3-A57B-10310FA8A847-2097371623' state changed from CERT_INSTALL_REQUESTED to CERT_INSTALL_REQUESTED 2019-04-11T21:18:31.3220000 VERB com.microsoft.omadm.platforms.android.certmgr.PfxCertificateManager 8380 00588 Successfully processed pfx certificate. PfxCertificateData converted into ClientCertificateState for install. 2019-04-11T21:21:12.8290000 INFO com.microsoft.omadm.platforms.android.certmgr.state.NativeRootCertInstallStateMachine 8380 00594 Root cert '17CECEA1D337FAA7D167AD83A8CC7A8FCBF95C69' state changed from CERT_INSTALLING to CERT_INSTALL_SUCCESS 2019-04-11T21:22:08.6310000 INFO com.microsoft.omadm.platforms.android.certmgr.PfxCertificateManager 8380 00602 Waiting to process PFX certificate until user gives us access to existing certificate. RequestId=E67A52B1-430D-4CD3-A57B-10310FA8A847-2097371623 2019-04-11T21:22:08.6330000 INFO com.microsoft.omadm.platforms.android.certmgr.PfxCertificateManager 8380 00602 Waiting to process PFX certificate until user gives us access to existing certificate. RequestId=E67A52B1-430D-4CD3-A57B-10310FA8A847-2097371623 2019-04-11T21:22:47.2400000 INFO com.microsoft.omadm.platforms.android.certmgr.CertInstallActivity 8380 00002 Installing private key for user certificate. RequestId: E67A52B1-430D-4CD3-A57B-10310FA8A847-2097371623 2019-04-11T21:22:47.5699999 VERB com.microsoft.omadm.platforms.android.certmgr.CertInstallActivity 8380 00002 Install requestCode '2' returned with result code: 0 2019-04-11T21:22:47.5699999 INFO com.microsoft.omadm.platforms.android.certmgr.CertInstallActivity 8380 00002 Installing user certificate. Key: E67A52B1-430D-4CD3-A57B-10310FA8A847-2097371623 2019-04-11T21:23:09.7860000 INFO com.microsoft.omadm.platforms.android.certmgr.state.NativeScepCertInstallStateMachine 8380 00608 SCEP cert 'E67A52B1-430D-4CD3-A57B-10310FA8A847-2097371623' state changed from CERT_INSTALLING to CERT_ACCESS_REQUESTED 2019-04-11T21:23:29.3360000 INFO com.microsoft.omadm.platforms.android.certmgr.state.NativeScepCertInstallStateMachine 8380 00612 SCEP cert 'E67A52B1-430D-4CD3-A57B-10310FA8A847-2097371623' state changed from CERT_ACCESS_REQUESTED to CERT_ACCESS_GRANTED On the Intune Certificate Connector computer, you will find a log file called NDESConnector_Date.svclog that contains valuable information about the processing of the PFX request. To view this log, I like to use Service Trace Viewer from the Windows SDK. Below I put a box around some of the key entries showing a successful processing of the PFX request, issuance, and uploading of the PFX user certificate. NDESConnector_Date.svclog We can also validate the issuance of PFX user certificates on the MS Certificate Authority computer: When the certificate is successfully processed, you will see the file associated with the PFX request in the following location: C:\Program Files\Microsoft Intune\PfxRequest\Succeed The file is readable with your faorite text editor. Below is a sample of some of the contents of the file using NotePad++ Now let’s see what this looks like on an iOS device: iOS Log Files Console Logs from the device svclog from the Intune Certificate Connector computer. By default this is found under C:\Program Files\Microsoft Intune\NDESConnectorSvc\Logs\Logs. If you’re not familiar with using a Mac to collect console logs from an iOS devices, here’s an example using a Mac running Sierra 10.12+ 1. Open the Console app from the Launchpad or Spotlight and attach your iOS device to your Mac. Make sure you select Trust this Computer on the iOS device. 2. On the Action tab, enable Include info messages and Include Debug messages: 3. From the Devices list on the left, select your iOS device: 4. Reproduce your issue. 5. To export the logs from the Console, the best way is to clear any search queries you may have, then go to the Menu Bar and select Edit -> Select All, then Edit -> Copy. You can then paste them into TextEdit to save the file in .txt format. Here’s an example of a console log showing root certificate activity: default 12:06:24.627809 -0400 securityd inserted
