Home certificate enrollment microsoft intune scep troubleshooting

Intune SCEP Certificate Delivery: Troubleshooting Guide for Enrollment Success

Updated: • 0 • min read
Table of Contents

This document provides comprehensive guidance for troubleshooting certificate delivery to devices managed by Microsoft Intune when utilizing the Simple Certificate Enrollment Protocol (SCEP). SCEP plays a crucial role in enabling devices to securely obtain certificates, which are essential for various authentication and security functionalities within an organization. When the Network Device Enrollment Service (NDES) server successfully retrieves a device’s requested certificate from the designated Certification Authority (CA), the subsequent step involves delivering this certificate back to the device. This article focuses specifically on this critical delivery phase, which corresponds to step 5 in the broader SCEP communication workflow, ensuring a smooth and successful certificate enrollment process.

Review the Certification Authority

A pivotal initial step in troubleshooting certificate delivery involves verifying the successful issuance of the certificate by the Certification Authority (CA). Examining the CA’s records provides crucial insights into whether the certificate request was processed and fulfilled correctly. Upon successful certificate issuance, the CA typically logs an entry that mirrors the example illustrated below. This entry serves as confirmation that the CA has completed its part of the process and that the certificate is ready for delivery to the requesting device.

To effectively review the Certification Authority, navigate to the CA server and access the Certificate Authority management console. Within the console, locate the “Issued Certificates” section. Here, you should be able to search for the certificate request based on device information or user details associated with the enrollment. A successful issuance will be indicated by a status of “Issued” alongside the relevant certificate details. Pay close attention to the “Request ID” and “Certificate Template” used, as these details can be cross-referenced with logs on the NDES server and the device itself for a complete end-to-end tracing of the certificate issuance process.

Review the Certification Authority

[Example CA Log Entry]
Event Type:        Information
Event Source:      Microsoft-Windows-CertificationAuthority
Event ID:          XX
Date:              YYYY-MM-DD
Time:              HH:MM:SS
User:              N/A
Computer:          YourCAServerName
Description:
Certificate issued to user@domain.com.
  Request ID:       XX
  Certificate Template: YourCertificateTemplate
  Serial Number:    XX
  ... (other relevant details) ...

If you do not find a successful “Issued” entry, it indicates a problem at the CA level. In such cases, investigate the CA’s “Failed Requests” or “Pending Requests” sections for more details. Common issues at the CA level include:

  • Certificate Template Permissions: Ensure the user or device account has the necessary permissions to request certificates based on the specified template.
  • CA Availability: Verify the CA server is online and accessible.
  • CA Policy Modules: Review any configured policy modules that might be rejecting the certificate request.
  • NDES Server Communication: Confirm that the NDES server can successfully communicate with the CA.

Review the Device

After confirming successful certificate issuance by the CA, the next crucial step is to examine the device itself to verify certificate delivery and installation. The method for reviewing the device varies depending on the operating system platform.

Android

For Android devices, the process of certificate installation differs based on the enrollment method.

Device Administrator Enrollment

On devices enrolled using the device administrator method, users typically receive a notification prompting them to manually install the certificate. This notification acts as a visual cue, alerting the user to the pending certificate installation. The user must interact with this notification to complete the certificate installation process.

Android Device Administrator Notification

Android Enterprise and Samsung Knox Enrollment

In contrast, for devices enrolled under Android Enterprise or Samsung Knox, the certificate installation is designed to be seamless and silent. This means that the certificate is installed automatically in the background without requiring any user intervention or notification. This streamlined approach enhances the user experience and reduces potential confusion or delays in certificate deployment.

Viewing Installed Certificates on Android

To inspect installed certificates on an Android device, you can utilize third-party certificate viewing applications available on the Google Play Store. These apps provide a user-friendly interface to browse and examine the certificates present on the device. Search for apps using keywords like “certificate viewer” or “SSL certificate inspector.”

Reviewing OMADM Logs for Android Devices

For more technical and in-depth troubleshooting on Android devices, examining the device’s OMADM (OMA Device Management) logs is highly recommended. These logs record detailed information about device management activities, including certificate enrollment processes. To access OMADM logs, you typically need to enable developer options on the Android device and use ADB (Android Debug Bridge) to retrieve the logs.

Within the OMADM logs, search for entries related to certificate installation. Look for log entries that resemble the examples provided below, which are specifically logged when certificates are successfully installed. These entries contain information about the root certificate installation and the SCEP-provisioned certificate installation.

Root Certificate Log Entries:

2018-02-27T04:50:52.1890000    INFO    Event     com.microsoft.omadm.platforms.android.certmgr.state.NativeRootCertInstallStateMachine     9595        9    Root cert '17...' state changed from CERT_INSTALL_REQUESTED to CERT_INSTALL_REQUESTED
2018-02-27T04:53:31.1300000    INFO    Event     com.microsoft.omadm.platforms.android.certmgr.state.NativeRootCertInstallStateMachine     9595        0    Root cert '17...' state changed from CERT_INSTALL_REQUESTED to CERT_INSTALLING
2018-02-27T04:53:32.0390000    INFO    Event     com.microsoft.omadm.platforms.android.certmgr.state.NativeRootCertInstallStateMachine     9595       14    Root cert '17...' state changed from CERT_INSTALLING to CERT_INSTALL_SUCCESS

These log entries track the state changes of the root certificate installation process, moving from “CERT_INSTALL_REQUESTED” to “CERT_INSTALLING” and finally to “CERT_INSTALL_SUCCESS,” indicating successful root certificate installation.

SCEP Certificate Log Entries:

2018-02-27T05:16:08.2500000    VERB    Event     com.microsoft.omadm.platforms.android.certmgr.CertificateEnrollmentManager    18327       10    There are 1 requests
2018-02-27T05:16:08.2500000    VERB    Event     com.microsoft.omadm.platforms.android.certmgr.CertificateEnrollmentManager    18327       10    Trying to enroll certificate request: ModelName=AC_51...%2FLogicalName_39907...;Hash=1677525787
2018-02-27T05:16:20.6150000    VERB    Event     org.jscep.transport.UrlConnectionGetTransport    18327       10    Sending GetCACert(ca) to https://<server>-contoso.msappproxy.net/certsrv/mscep/mscep.dll?operation=GetCACert&message=ca
2018-02-27T05:16:20.6530000    VERB    Event     org.jscep.transport.UrlConnectionGetTransport    18327       10    Received '200 OK' when sending GetCACert(ca) to https://<server>-contoso.msappproxy.net/certsrv/mscep/mscep.dll?operation=GetCACert&message=ca
2018-02-27T05:16:21.7460000    VERB    Event     org.jscep.transport.UrlConnectionGetTransport    18327       10    Sending GetCACaps(ca) to https://<server>-contoso.msappproxy.net/certsrv/mscep/mscep.dll?operation=GetCACaps&message=ca
2018-02-27T05:16:21.7890000    VERB    Event     org.jscep.transport.UrlConnectionGetTransport    18327       10    Received '200 OK' when sending GetCACaps(ca) to https://<server>-contoso.msappproxy.net/certsrv/mscep/mscep.dll?operation=GetCACaps&message=ca
2018-02-27T05:16:28.0340000    VERB    Event     org.jscep.transaction.EnrollmentTransaction    18327       10    Response: org.jscep.message.CertRep@3150777b[failInfo=<null>,pkiStatus=SUCCESS,recipientNonce=Nonce [GUID],messageData=org.spongycastle.cms.CMSSignedData@27cc8998,messageType=CERT_REP,senderNonce=Nonce [GUID],transId=TRANSID]
2018-02-27T05:16:28.2440000    INFO    Event     com.microsoft.omadm.platforms.android.certmgr.state.NativeScepCertInstallStateMachine    18327       10    SCEP cert 'ModelName=AC_51...%2FLogicalName_39907...;Hash=1677525787' state changed from CERT_ENROLLED to CERT_INSTALL_REQUESTED
2018-02-27T05:18:44.9820000    INFO    Event     com.microsoft.omadm.platforms.android.certmgr.state.NativeScepCertInstallStateMachine    18327        0    SCEP cert 'ModelName=AC_51...%2FLogicalName_39907...;Hash=1677525787' state changed from CERT_INSTALL_REQUESTED to CERT_INSTALLING
2018-02-27T05:18:45.3460000    INFO    Event     com.microsoft.omadm.platforms.android.certmgr.state.NativeScepCertInstallStateMachine    18327       14    SCEP cert 'ModelName=AC_51...%2FLogicalName_39907...;Hash=1677525787' state changed from CERT_INSTALLING to CERT_ACCESS_REQUESTED
2018-02-27T05:20:15.3520000    INFO    Event     com.microsoft.omadm.platforms.android.certmgr.state.NativeScepCertInstallStateMachine    18327       21    SCEP cert 'ModelName=AC_51...%2FLogicalName_39907...;Hash=1677525787' state changed from CERT_ACCESS_REQUESTED to CERT_ACCESS_GRANTED

These SCEP certificate log entries provide a detailed step-by-step record of the SCEP enrollment process. Key events to observe include:

  • Trying to enroll certificate request: Indicates the start of the enrollment process for a specific certificate request.
  • Sending GetCACert(ca) and Sending GetCACaps(ca): Show the device retrieving the CA certificate and capabilities from the NDES server.
  • Response: org.jscep.message.CertRep@...pkiStatus=SUCCESS: A crucial entry confirming that the SCEP server responded successfully with the certificate. A pkiStatus=FAILURE here would indicate an issue on the SCEP server side.
  • State changes from CERT_ENROLLED to CERT_INSTALL_REQUESTED to CERT_INSTALLING to CERT_ACCESS_REQUESTED to CERT_ACCESS_GRANTED: These state changes track the progress of the certificate installation on the device, culminating in CERT_ACCESS_GRANTED, which signifies successful installation and access to the certificate.

iOS/iPadOS

On iOS and iPadOS devices, certificate verification can be performed through the Device Management Profile settings and by examining device debug logs.

Device Management Profile

To view installed certificates via the Device Management Profile, navigate to Settings > General > Device Management. Under the MDM profile associated with your organization, you will find a list of installed profiles, including certificate profiles. Drilling down into the certificate profile details will display information about the installed certificates.

iOS Device Management Profile

Reviewing iOS/iPadOS Debug Logs

For more detailed information, you can examine the iOS/iPadOS debug logs. Accessing these logs typically requires connecting the device to a computer running macOS and using Xcode or configuration profiles to capture device logs.

Within the debug logs, search for entries resembling the following examples. These entries highlight key steps in the SCEP certificate enrollment process on iOS/iPadOS.

Debug 18:30:53.691033 -0500 profiled Performing synchronous URL request: https://<server>-contoso.msappproxy.net/certsrv/mscep/mscep.dll?operation=GetCACert&message=SCEP%20Authority
Debug 18:30:54.640644 -0500 profiled Performing synchronous URL request: https://<server>-contoso.msappproxy.net/certsrv/mscep/mscep.dll?operation=GetCACaps&message=SCEP%20Authority
Debug 18:30:55.487908 -0500 profiled Performing synchronous URL request: https://<server>-contoso.msappproxy.net/certsrv/mscep/mscep.dll?operation=PKIOperation&message=MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgMFADCABgkqhkiG9w0BBwGggCSABIIZfzCABgkqhkiG9w0BBwOggDCAAgEAMYIBgjCCAX4CAQAwZjBPMRUwEwYKCZImiZPyLGQBGRYFbG9jYWwxHDAaBgoJkiaJk/IsZAEZFgxmb3VydGhjb2ZmZWUxGDAWBgNVBAMTD0ZvdXJ0aENvZmZlZSBDQQITaAAAAAmaneVjEPlcTwAAAAAACTANBgkqhkiG9w0BAQEFAASCAQCqfsOYpuBToerQLkw/tl4tH9E+97TBTjGQN9NCjSgb78fF6edY0pNDU+PH4RB356wv3rfZi5IiNrVu5Od4k6uK4w0582ZM2n8NJFRY7KWSNHsmTIWlo/Vcr4laAtq5rw+CygaYcefptcaamkjdLj07e/Uk4KsetGo7ztPVjSEFwfRIfKv474dLDmPqp0ZwEWRQG
Debug 18:30:57.285730 -0500 profiled Adding dependent Microsoft.Profiles.MDM to parent www.windowsintune.com.SCEP.ModelName=AC_51bad41f.../LogicalName_1892fe4c...;Hash=-912418295 in domain ManagedProfileToManagingProfile to system
Default 18:30:57.320616 -0500 profiled Profile '93www.windowsintune.com.SCEP.ModelName=AC_51bad41f.../LogicalName_1892fe4c...;Hash=-912418295'94 installed.

Key log entries to analyze include:

  • Performing synchronous URL request: ... GetCACert ... and ... GetCACaps ...: Similar to Android logs, these indicate the retrieval of CA certificate and capabilities.
  • ... PKIOperation ...: This entry signifies the actual SCEP request being sent to the NDES server.
  • Profile '...SCEP...' installed.: This crucial log line confirms the successful installation of the SCEP profile, which includes the certificate, on the iOS/iPadOS device.

Windows

On Windows devices, certificate delivery verification involves checking both the Event Viewer and the Certificate Manager MMC (Microsoft Management Console).

Event Viewer

The Event Viewer provides a record of system events, including those related to device management and certificate operations. To check for SCEP certificate installation events, follow these steps:

  1. Run eventvwr.msc to open the Event Viewer.
  2. Navigate to Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostic-Provider > Admin.
  3. Look for Event ID 39.

Event ID 39 with the description “SCEP: Certificate installed successfully.” indicates that the SCEP certificate has been successfully installed on the Windows device.

Windows Event Viewer Event 39

Certificate Manager MMC

The Certificate Manager MMC allows you to directly view the certificates installed on the Windows device. To verify certificate delivery using the Certificate Manager, perform the following:

  1. Run certmgr.msc to open the Certificates MMC.
  2. Verify Root Certificate Installation:
    • Navigate to Certificates (Local Computer) > Trusted Root Certification Authorities > Certificates.
    • Locate the root certificate from your CA.
    • Confirm that the Issued To and Issued By fields are identical, as this is characteristic of a root certificate.
  3. Verify SCEP Certificate Installation:
    • Navigate to Certificates - Current User > Personal > Certificates.
    • Find the requested SCEP certificate.
    • Verify that the Issued By field matches the name of your Certification Authority.

Windows Certificate Manager MMC

Successfully finding both the root certificate in the Trusted Root Certification Authorities store and the SCEP certificate in the Personal store confirms that the certificate delivery and installation process on the Windows device was successful.

Troubleshoot Failures

If certificate delivery is unsuccessful, the troubleshooting approach varies slightly depending on the device operating system. However, the common thread is to leverage the logging mechanisms discussed in the previous sections.

Android Troubleshooting

For Android devices, the primary troubleshooting method involves a thorough review of the OMA DM logs. Analyze the logs for error messages or failure indicators during the certificate enrollment process. Pay close attention to entries related to network connectivity, SCEP server communication, and certificate installation attempts. Error codes within the logs can often provide specific clues to the root cause of the failure.

iOS/iPadOS Troubleshooting

Troubleshooting certificate delivery failures on iOS/iPadOS devices relies heavily on examining the device debug logs. Similar to Android, scrutinize the logs for error messages, connection issues, or failures during the SCEP communication steps. Look for any indications of problems during the GetCACert, GetCACaps, or PKIOperation stages.

Windows Troubleshooting

When certificates are not installing on Windows devices, the Windows Event log is the primary source of troubleshooting information. Examine the DeviceManagement-Enterprise-Diagnostic-Provider > Admin log for error events. While errors in this log can indicate issues, it’s important to note that delivery and installation problems on Windows are often related to underlying Windows operating system operations rather than Intune itself. This means that troubleshooting might involve investigating Windows certificate services, network connectivity at the OS level, or permissions issues within the Windows environment.

In all operating systems, common failure points to investigate include:

  • Network Connectivity: Ensure the device has a stable network connection to reach the NDES server and the CA.
  • SCEP Server Availability: Verify the NDES server is online and responding to requests.
  • URL Configuration: Double-check the SCEP profile in Intune to ensure the NDES server URL is correctly configured and reachable from the devices.
  • Certificate Profile Configuration: Review the SCEP certificate profile settings in Intune for any misconfigurations, such as incorrect certificate templates or key usage settings.
  • NDES Server Logs: Complement device-side logs with logs from the NDES server itself to get a broader picture of the certificate request flow and identify any server-side issues.

Next Steps

Successfully troubleshooting SCEP certificate delivery is crucial for maintaining secure and functional device management within your organization. By systematically reviewing CA records, device logs, and system events, you can pinpoint the root cause of certificate delivery issues and ensure smooth certificate enrollment for your managed devices. Continue to monitor certificate deployment and proactively address any emerging issues to maintain a robust and secure Intune environment.

If you found this guide helpful or have further questions regarding SCEP certificate troubleshooting, please leave a comment below! Your feedback and shared experiences are valuable to the community.

Post a Comment