I installed SCCM 2007 SP2 on Windows 2008 x86.
For native mode PKI i used this documentation http://technet.microsoft.com/en-us/library/bb680312.aspx, CA is Windows 2008 R2 Enterprise.
Certificates were assigned and enrolled with GPOs.
I have this errors on for MP hourly. An the SMS Host Agent is found in stopping State
MP Control Manager detected DMP is not responding to HTTP requests. The http error is 12030.
Possible cause: DMP service is not started or not responding on all DMP physical machines.
Solution: Manually restart the SMS Agent Host service on the DMP.
Possible cause: IIS service is not responding.
Solution: Manually restart the W3SVC service on the MP.
For more information, refer to Microsoft Knowledge Base article 838891.
------------------------------------------------------
MP Control Manager detected DMP is not responding to HTTP requests. The http error is 12030.
Possible cause: DMP service is not started or not responding on all DMP physical machines.
Solution: Manually restart the SMS Agent Host service on the DMP.
Possible cause: IIS service is not responding.
Solution: Manually restart the W3SVC service on the MP.
For more information, refer to Microsoft Knowledge Base article 838891.
I found some errors regarding certificates in logs
mpcontrol.log :
Certificate has "SSL Client Authentication" capability. $$<SMS_MP_CONTROL_MANAGER><Sat Apr 10 14:06:00.291 2010 GTB Daylight Time><thread=3636 (0xE34)>
Call to HttpSendRequestSync failed for port 443 with an error code. $$<SMS_MP_CONTROL_MANAGER><Sat Apr 10 14:06:00.307 2010 GTB Daylight Time><thread=3636 (0xE34)>
Http test request failed, error code is 12030.~ $$<SMS_MP_CONTROL_MANAGER><Sat Apr 10 14:06:00.307 2010 GTB Daylight Time><thread=3636 (0xE34)>
Successfully performed Management Point availability check against local computer.~ $$<SMS_MP_CONTROL_MANAGER><Sat Apr 10 14:06:00.307 2010 GTB Daylight Time><thread=3636 (0xE34)>
Machine name is 'srv-dyno.ebs.msft'. $$<SMS_MP_CONTROL_MANAGER><Sat Apr 10 14:06:00.307 2010 GTB Daylight Time><thread=3636 (0xE34)>
CryptVerifyCertificateSignatureEx returned error 0x80090006. $$<SMS_MP_CONTROL_MANAGER><Sat Apr 10 14:06:00.307 2010 GTB Daylight Time><thread=3636 (0xE34)>
Certificate doesn't have "SSL Client Authentication" capabilities. $$<SMS_MP_CONTROL_MANAGER><Sat Apr 10 14:06:00.307 2010 GTB Daylight Time><thread=3636 (0xE34)>
Skipping certificate that is not valid for ConfigMgr usage. $$<SMS_MP_CONTROL_MANAGER><Sat Apr 10 14:06:00.307 2010 GTB Daylight Time><thread=3636 (0xE34)>
There are no certificate(s) that meet the criteria. $$<SMS_MP_CONTROL_MANAGER><Sat Apr 10 14:06:00.307 2010 GTB Daylight Time><thread=3636 (0xE34)>
Performing machine FQDN to SAN2 search. $$<SMS_MP_CONTROL_MANAGER><Sat Apr 10 14:06:00.307 2010 GTB Daylight Time><thread=3636 (0xE34)>
Certificate doesn't have SAN2 extension. $$<SMS_MP_CONTROL_MANAGER><Sat Apr 10 14:06:00.307 2010 GTB Daylight Time><thread=3636 (0xE34)>
Certificate doesn't have SAN2 extension. $$<SMS_MP_CONTROL_MANAGER><Sat Apr 10 14:06:00.307 2010 GTB Daylight Time><thread=3636 (0xE34)>
CryptVerifyCertificateSignatureEx returned error 0x80090006. $$<SMS_MP_CONTROL_MANAGER><Sat Apr 10 14:06:00.307 2010 GTB Daylight Time><thread=3636 (0xE34)>
Certificate has "SSL Client Authentication" capability. $$<SMS_MP_CONTROL_MANAGER><Sat Apr 10 14:06:00.307 2010 GTB Daylight Time><thread=3636 (0xE34)>
Call to HttpSendRequestSync failed for port 443 with an error code. $$<SMS_MP_CONTROL_MANAGER><Sat Apr 10 14:06:00.322 2010 GTB Daylight Time><thread=3636 (0xE34)>
Http test request failed, error code is 12030.~ $$<SMS_MP_CONTROL_MANAGER><Sat Apr 10 14:06:00.322 2010 GTB Daylight Time><thread=3636 (0xE34)>
Successfully performed Device Management Point availability check against local computer.~ $$<SMS_MP_CONTROL_MANAGER><Sat Apr 10 14:06:00.322 2010 GTB Daylight Time><thread=3636 (0xE34)>
Website https://sccm2007.domain.local does work from every client but not from the server itself
Internet Explorer cannot display the webpage.
