In the previous versions of Configuration Manager, setting up a secure communication on your site was often difficult and not very flexible in that we could only tell clients to communicate using one mode or another. This was known as mixed mode and native mode, which was set at a site level. With Configuration Manager 2012, these site modes have gone and site system roles now support communication with either HTTP or HTTPS depending on the configuration. This has been moved from the site configuration and makes it much easier to set up and deploy, even in live environments.

In this section, we will go through the entire setup process to have your client's communication with site system roles secure using HTTPS.

To begin configuring your Configuration Manager site to start using secure communication, you will require a CER file of your root CA. The file you export must be a DER X.509 certificate.

In the administration workspace, expand the site configuration node and select Sites. Right-click on your site and then select Properties. In the Client Computer Communication tab, you have the ability to set options on how clients communicate with your site.

Import your root CA certificate by clicking on Set at the bottom of the window. You can import multiple root certificates if required. This functionality supports environments that may have multiple certificate authorities.

The certificates you specify here will be used to verify the certificate chain of any certificates configured in the hierarchy. You are recommended to make sure that your clients are properly communicating with a HTTP management point and distribution point as well as software update point before...

You can still use your certificates from your internal certificate authority on workgroup computers. When clients are on the domain, we use autoenrolment to make sure our clients get the correct certificate.

While not as intuitive and simple as deploying certificates on the domain, however, we can use a script to first generate the certificate request. The next code does just that. First of all, we need to define the client name; this should be entered to make sure the certificate request is correct.

The next section of code generates the certificate request as well as saying what the template is. The certificate will generate a new certificate and then export the created certificate. Lines that require editing have been highlighted; this script should be executed as an administrator:

set subjectname=client.fqdn.co.uk
echo Generating INF file for certificate
echo ;—————CertificateRequestTemplate.inf——...

In this chapter, we have explored the world of using certificates to secure our Configuration Manager environment. We have gone through the high-level process of setting up a test certificate authority and configuring the certificate templates.

It is also possible to set Configuration Manager so clients can sign and encrypt communication to their management point. If implementing certificates is overkill for you, this is also a good security step.

We also looked at the configuration steps involved to let Configuration Manager know about our certificates and enable our clients to communicate with our site using the certificates we have generated.

Finally, we explored how to generate certificates to use for our workgroup clients where we cannot use the domain to automatically enroll the certificates. In the next chapter, we will look at how to use inventory to our advantage and how to configure the inventory to work for us.