<p style="padding: 0px; margin: 0px 0px 10px 0px;"><a href="http://wincert.net/wp-content/uploads/2015/01/windows-server2.jpg"><img class="alignnone size-full wp-image-551" src="http://wincert.net/wp-content/uploads/2015/01/windows-server2.jpg" alt="Windows Server,access,permission,ipsec fails,printers offline,printer installation,trusted sites,item,installation file missing,user profiles,terminal services,dhcp superscope" width="720" height="340" /></a></p>
<p style="padding: 0px; margin: 0px 0px 10px 0px;">Microsoft supports running SCCM 2007 SP2 on a 2008 R2 server, but I’m doubting whether or not running SCCM 2007 SP2 in Native mode in an environment using a 2008 R2 CA is supported (and if so, there’s an issue to be aware of). Specifically, it seems like client certificates created with a 2008 R2 CA (following the <a style="color: #2970a6; text-decoration: none;" href="http://technet.microsoft.com/en-us/library/cc872789.aspx" target="_blank">instructions on Technet</a> for a 2008 CA) do not work by default in SCCM 2007 when running a site in Native mode (you’ll get MP errors stating that it cannot connect via HTTP, and mpcontrol.log will contain errors that the SAN2 fields have errors). <!--more--></p>
<p style="padding: 0px; margin: 0px 0px 10px 0px;">It seems if you create your 2008 R2 CA with the default Key store provider, the client certificates just do not work. However, if you create your 2008 R2 CA with the Microsoft Strong cryptography provider (which is the default for 2003 and 2008 CAs), magically the certs created work fine. If you look at the contents of the certs created between a 2008 and 2008 R2 CA, they “look” identical, but something else must be happening I haven’t dug into yet.</p>
<p style="padding: 0px; margin: 0px 0px 10px 0px;">I don’t know if a 2008 R2 CA is technically supported for use with 2007 SCCM certificates, but for those of you who are doing this, be aware that how you set up your CA on it’s initial install will determine if your client certificates work properly or not.</p>
<p style="padding: 0px; margin: 0px 0px 10px 0px;">There are workarounds, of course, for those few of you who are already running 2008 R2 CAs from a default installation &#8211; in the Site Mode tab of the Site properties, you can change the “If multiple certificates match criteria:” from “Fail selection and send error message” to “Select any certificate that matches”, and set “Certificate criteria:” to “Check only certificate purpose”.</p>
<p style="padding: 0px; margin: 0px 0px 10px 0px;">Doing this allows the MP communications to start up again, although I’m not sure of the potential risks (if any) that are taken if you allow this.</p>
<p style="padding: 0px; margin: 0px 0px 10px 0px;">[<a href="http://www.cluberti.com/blog/2010/05/24/sccm-2007-client-certificate-issues-with-2008-r2-ca/" target="_blank">cluberti</a>]</p>