Creating Boot Media in Native mode

[Paul H]

Hi all,

 

We've setup SCCM 2007 r3 in native mode on a server 2008 r2 sp1 OS.

MDT2010 also installed

site server signing certificate web server certificate and client certificate are OK.

But now i want to create Task sequence boot media.

What has been done so far..

Duplicated the SCCM client certificate template and set the allow private key to be exported switch

From a freshly (manually) installed windows 7 sp1 machine requested a certificate from the duplicated template.

Exported this certificate with the private key and tried to use this in the boot media.

 

basically thats what it says here: http://technet.microsoft.com/en-us/library/bb632961.aspx

 

We keep getting "Unspecified error, refer to CreateMedia.log"

In that log it states: "Could not get name from cert context"

 

At first, while requesting the cert, we did not bother to fill in any fields in the properties. After a fail we tried filling in the common name, friendly name and description in various combinations all resulting in "Could not get name from cert context""

 

Could this be a SP1 issue? Or are we filling in the wrong fields or missing something else.

I've also seen an extra setting to be applied to the CA: "certutil -setreg policy \EditFlags +EDITF_ATTRIBUTESUBJECTALTNAME2" to add the SAN attribute. This is something we do not have. Could that be the problem? The CA administrator is reluctant to try this, i'm looking for arguments here...

 

 

 

Any help would be appreciated...

Thanks in advance.

[Paul H]

by now i'm convinced the certutil -setreg policy \EditFlags +EDITF_ATTRIBUTESUBJECTALTNAME2 on the CA is absolutely necessary.

 

But i still get the same error: Could not get name from cert context

 

i created a windows7 VM. From that machine i requested a certificate. in the wizard i open the properties of the request and fill friendly name, description, common name and alternate name. I tried several combinations including not filling in anything and leaving out some fields. Always the same result: FAIL.

 

Can anybody tell me which fields i have to fill and what do i have to fill them with?

 

Can i keep the VM on which i requested and installed the certificate while i try to create the bootmedia or do i have to delete it (and remove it from AD and DNS)?

 

i'm going ballistic here.. please help!

[Peter van der Woude]

Take a look here: http://www.myitforum.com/forums/OSD-certificate-for-boot-Media-in-Native-mode-is-a-nightmare-m225360.aspx (it's all about the common name)

 

The command certutil -setreg policy \EditFlags +EDITF_ATTRIBUTESUBJECTALTNAME2 is needed when you need to use multiple SANS (like with Internet Clients)

Edited March 4, 2011 by Peter van der Woude
Had the wrong link...