Step-By-Step Procedure To Create A SCOM Certificate Template

---

System Center Operation Manager or OpsMgr in short SCOM, a tool plays a key role in maintaining the health of the whole Windows infrastructure of an organization. IT teams use this tool to monitor the health & performance, send configurations, apply OS & app patches, and run the scripts on SCOM agents to keep the health of infra. To make use of SCOM services, all the workstations and servers should be connected and reporting to the SCOM servers. SCOM can manage the domain workstations and domain servers using the default Kerberos protocol over the network ports 5723 & 5724. But, how SCOM will manage the workgroup computers and the machines which are in a domain that doesn’t trust Ops Manager? This is why SCOM needs digital certificates to manage untrusted SCOM clients. SCOM can manage the untrusted clients by importing certificates in both Gateway or Management Server and the client machine not joined to the domain. This required creating a specific certificate template in the internal CA server to issue the certificates for SCOM clients, the management server, and gateways. So, we have created the detailed step-by-step procedure to create a SCOM certificate template in this post.

Follow this procedure to create a SCOM certificate template on the internal CA servers.

Time needed: 10 minutes.

How to Create a SCOM Certificate Template?

1. Open Certificate AuthorityIssue the ‘certsrv’ command on the CLI
2. Open certificate management templateRight click on the ‘Certificate Template’.
   
3. Create a duplicate template from “Ipsec offline request” template
4. General settings on SCOM certificate templateFill the Template Name, Validity, and Renewal Period in the general setting tab
   
   
5. Compatibility settings on SCOM certificate templateChoose ‘Windows Server 2003‘ in the Capability Authority dropdown and Windows XP/ Server 2003 in the ‘Certificate recipient‘ dropdown
   
   
6. Request Handling settings on SCOM certificate templateSet the Purpose to the ‘Signature and Encryption‘ and check the ‘Allow private key to be exported.
   
   
7. Cryptography settings on SCOM certificate templateSet these three settings in the cryptography settings tab.
   
   Provider Category: Legacy Cryptography Service Provider
   Algorithm name: Determined by CSP
   Minimum Key Size: 1024 or 2048 as per Organisation security requirement.
   
   Select the ‘Request must use one of the following providers‘
   Click on ‘Microsoft RSA SChannel Cryptographic Provider
   
   
   
8. Key Attestation settings on SCOM certificate templateThe Key Attestation tab should look like the one below
   
   
9. Server settings on SCOM certificate templateIt should be like this
   
   
10. Application Policies settings on SCOM certificate templateEdit the ‘Application Policies‘. Add the Server Authentication and Client Authentication Policies to the Application Policy.
    
    
11. Application policy in Extension settings on SCOM certificate templateApplication policy should look like this
    
    
12. Basic Constraints in Extension settings on SCOM certificate templateTake a look at the Basic Constraints in Extension settings
    
    
13. Issuance policy in Extension settings on SCOM certificate templateSee the Issuance policy in Extension settings below
    
    
14. Key usage in Extension settings on SCOM certificate templateEdit ‘Key Usage‘
    Select ‘Digital Signature‘ under the signature
    Select ‘Allow key exchange only with key encryption‘
    Select ‘Make this extension critical‘
    
    
15. Subject Name settings on SCOM certificate templateSelect ‘Supply in the request‘
    
    
16. Issuance requirements settings on SCOM certificate templateYour Issuance requirements should be like this
    
    
17. Publish the certificate templateAfter creating the certificate template publish the template.
    1. Right Click on Certificate Template
    2. Click New
    3. Click Create Template to issue
    

 

Upon you create a SCOM certificate template, create certificate syringing request from a SCOM client computer and submit the CSR and get it signed with your internal PKI server. After you get the certificate check the private key is exported along with the certificate as shone here.

Thanks for reading the post. Please share the post with those who are struggling to create a SCOM certificate template on their internal CA server.