0

Good evening.

So, here is my problem: I'm responsible to set up all NDES infrastructure to provide SCEP certificate for Android devices enrolled in Intune.

After exhaustively covering all installation/configuration steps in the infrastructure, my test device simply can't enroll to the certificate.

So, I would like to ask if anyone else found this very same problem that could give me a hint about what could be the error?

`

2022-10-30T15:52:01.2350000 VERB    org.jscep.client.Client 25727   03516   Requesting certificate verification.
2022-10-30T15:52:01.6350000 INFO    com.microsoft.intune.omadm.cryptography.androidapicomponent.abstraction.GetCertificateChainUseCase  25727   03516   Certificate chain built with length 1, rootIssuerFound = true
2022-10-30T15:52:01.6370000 VERB    org.jscep.client.Client 25727   03516   Certificate verification failed.
2022-10-30T15:52:01.6380000 ERR_    com.microsoft.omadm.platforms.android.certmgr.CertificateRequestHandler 25727   03516   Enrollment request failed
    org.jscep.client.ClientException: CA certificate fingerprint could not be verified.
        org.jscep.client.Client.verifyCA(:752)
        org.jscep.client.Client.getCaCertificate(:282)
        org.jscep.client.Client.getEncoder(:699)
        org.jscep.client.Client.enrol(:623)
        com.microsoft.omadm.platforms.android.certmgr.CertificateRequestHandler.enrollCertificate(:181)
        com.microsoft.omadm.platforms.android.certmgr.CertificateRequestHandler.processRequest(:123)
        com.microsoft.omadm.platforms.android.certmgr.CertificateEnrollmentManager.tryEnrollCertificate(:123)
        com.microsoft.omadm.platforms.android.certmgr.CertificateEnrollmentManager.enrollPendingCertificates(:205)
        com.microsoft.omadm.platforms.android.provider.CertificateEnrollmentProvider$CertificateRequestPolicy.enforce(:400)
        com.microsoft.omadm.client.tasks.TemporaryOMADMClientExecutorTask.checkComplianceAndEnforceForUser(:915)
        com.microsoft.omadm.client.tasks.TemporaryOMADMClientExecutorTask.updatePolicyForUser(:805)
        com.microsoft.omadm.client.tasks.TemporaryOMADMClientExecutorTask.updatePolicy(:1278)
        com.microsoft.omadm.client.tasks.TemporaryOMADMClientExecutorTask.run(:255)
        com.microsoft.omadm.taskexecutor.TaskExecutor$InternalExecutorRunner.run(:322)
        java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:462)
        java.util.concurrent.FutureTask.run(FutureTask.java:266)
        java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167)
        java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641)
        java.lang.Thread.run(Thread.java:923)

`

Intune console doesnt give any hint what is the problem, but I managed to recover my test device logs, and the main log error is "CA certificate fingerprint could not be verified. ". Below is part of the error.

Pantafernando
  • 1

1 Answers1

0

Fixed by removing unused certificates in truststore.

Pantafernando
  • 1
  • Your answer could be improved with additional supporting information. Please [edit] to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers [in the help center](/help/how-to-answer). – Community Nov 07 '22 at 06:26
  • We are facing the same issue. What do you mean with "removing unused certificates in truststore"? We have like 8 certificates in the user store, most will be from Intune/Company Portal. – Stephan Bisschop May 08 '23 at 07:04