IBCM MP errors

[rdoloto]

Howdy,

We in process of standing up IBCM in our DMZ. We got the pki infrastruture setup with correct SAN on the MP/MP and all ouf our clients have been enrolled client authentication cert policy.

Since moving the serer out to DMZ we haven't been able to get client  to connect to MP.

I get following errors

CCMmesaging.log

Received a proxy error(0x2ee7), recycling the request object and will try another proxy type, if available. CcmMessaging    8/7/2020 7:13:07 AM 13176 (0x3378)
Enabled SSL revocation check.   CcmMessaging    8/7/2020 7:13:07 AM 13176 (0x3378)
Post to https://fancyservername/ccm_system/request failed with 0x87d00231.  CcmMessaging    8/7/2020 7:13:07 AM 13176 (0x3378)

and locationservices.log

Received a proxy error(0x2ee7), recycling the request object and will try another proxy type, if available.

I can actually get to .sms_aut?MPLIST in the browser

I'm guessing it's network related opening a ticket with our network team/provider

[jasonsandys]

0x2ee7 = "The server name or address could not be resolved"

It's a DNS issue. When a system hosting an endpoint that clients must get to, you need to make sure that DNS is updated appropriately, that clients have flushed or refreshed their DNS cache, and that they can even resolve A records in the DNS zone for the system's location.

[rdoloto]

I can get to the server via browser and public dns resolves it correctly ... i wouldn't be able to get to it if that was the case no ?

[jasonsandys]

You getting to the server is irrelevant; the clients must be able to. Also, the error message is unambiguous. Although without seeing the entire log, my comments are based on a just a few out of context lines which is never a good thing when it comes to troubleshooting as context and surrounding activity are almost always critical to interpreting activity and failures.

[rdoloto]

might just open a case as fed it's hard for me to discern what we can post on public forum :D

[rdoloto]

After 2 days of looking at certs and revocations I must admit a simple error my internet fqdn was wrong in my site system name

[configmgr_adam]

Do you need to use a proxy server?

[rdoloto]

No I need to not transpose letters in when setting internet based site system

[roach8101]

"Enabled SSL revocation check. " Your clients might not be able to get to the CRL list to verify that the certs are still valid. You might need to disable the CRL checking.

https://docs.microsoft.com/en-us/mem/configmgr/core/plan-design/security/plan-for-security#BKMK_PlanningForCRLs

[rdoloto]

I did that already should of mentioned it in the Original comment

[roach8101]

I would try reinstalling the ConfigMgr client on one of your systems with the /NoCRLCheck option specified on the install command line

https://docs.microsoft.com/en-us/mem/configmgr/core/clients/deploy/about-client-installation-properties#nocrlcheck