SCCM CMG Setup Guide – Part 2 | Issue, Enroll & Export Server Authentication Certificate

The cloud management gateway (CMG) provides a simple way to manage Configuration Manager client over internet. In the first part of this blog post series, we discussed about CMG prerequisites and requirements.

In this post, we will discuss about web server authentication certificate requirements for CMG. We will issue PKI certificate from Microsoft PKI, enroll that to SCCM primary site server and export the same to .PFX format to use during CMG setup.

Post in this series:

Issue Web Server Authentication Certificate for CMG

A web server authentication certificate is required to establish secure communication between Configuration Manager and Cloud Management Gateway service hosted in Azure.

Follow the below steps to issue a web server (IIS Server) authentication certificate from Microsoft PKI.

On the server running the certification authority, open the Certification Authority Console, right click Certificates Templates and select Manage.

Certmgmt console | Server Authentication Certificate

In the Certificate Template Management console, Right click on Web Server template and then select Duplicate Template

Certmgmt console

In the Duplicate Template dialog box, ensure that Windows Server 2003 is selected in Certification Authority option.

Certificate template

In the General tab, enter a template name <Name>. Change the validity period as required.

Certificate template

In the Request Handling tab, select Allow private key to be exported

Certificate template

In the Security tab, remove the Enroll permission from the Enterprise Admins security group

Certificate template

Choose Add, enter SCCM IIS servers in the text box and then Choose Ok

Certificate template

Select the Enroll and Read permission for this group. Choose Ok, Close the Certificate Templates Console.

Certificate template

Back in the Certification Authority console, right click Certificates Templates, select New / Certificate Template to Issue

Certificate template

In the Enable Certificate Template window, select the new template you just created, <Techuisitive SCCM CMG Certificate> , Click Ok

Certificate template

Enroll Web Server Authentication certificate on SCCM server

We have issued a web server authentication certificate in previous steps. Now we need to enroll the certificate on SCCM primary site server.

RDP to SCCM Primary site server and follow the below steps to enroll the certificate.

Go to run, type certlm.msc and press enter to launch Local Certificate Store

In the console, expand Certificates (Local computer) / Personal / Certificates

Right click Certificates, select All Tasks / Request New Certificate

Request New Certificate

On the Before you Begin page, click Next

If you see the Select Certificate Enrolment Policy page, chose Next

On the Request Certificates page, identify <Web Server Certificate your created> from the list, and then select More information is required to enroll for this certificate. Choose here to configure settings.

Certificate enrollment

In the Certificate Properties dialog box, in the Subject tab, provide the following details.

Subject Name:

o Type : Common Name

o Value:

Click on Add

Alternative name:

o Type: DNS

o Value:

Click on Add

Note: The value ( is CMG Service Name which we identified in pre-requisites.

Certificate template

In the General tab, enter an friendly name for certificate. Click Ok to close the Certificate Properties dialog box

Certificate template

On the Request Certificates page, select <Techuisitive SCCM CMG Certificate> from the list of available certificates, click Enroll.

Certificate enrollment

On the Certificates Installation Results page, wait until the certificate is installed.

click Finish

Certificate template

Certificate should now be available in Personal > Certificates folder.


Export Certificate with Private Key

On the SCCM server, in Certificates (Local computer) console, right click <Web Server Certificate> that you just created, select All Tasks / Export

Export Certificate

In the Certificates Export Wizard, choose Next

On the Export Private key Page, select Yes, export the private key, click Next

Export Certificate

On the Export file format page, ensure that the Personal information Exchange – PKCS #12 (.PFX) option is selected.

Select Include all certificates in the certification path if possible , Click Next

Export Certificate

On the Security page, specify a strong password to protect the exported certificate with its private key, and the click Next

Export Certificate

On the File to Export page, specify the name of the file that you want to export and click on Next to Finish export.

Export Certificate

Next Post : Part 3 | Configure SCCM Site for SSL

Related posts:

Scroll to Top