Certificate chains are installed for SSL communication to the Root Certificate Authority. If you will be doing a certificate change for the Symantec Management Platform (SMP or NS) Server and Site Servers, this article will provide you information on why this happens and that it cannot be changed.
ITMS 8.x
The following information is provided for reference and it is not intended to be a detailed technical document on how things works with certificate procedures.
Our certificate distribution system is a work in progress and an overview is:
If you have a newer version of the Symantec Management Agent (SMA), those friendly names like "SMA: NS: Web Site certificate" are no longer being added by the SMA, so it's hard to tell if a particular certificate in the chain is an intermediate certificate or not. It is intermediate in the sense that it is signed by a root certificate and some other certificate is signed by it, but theoretically, nobody prevents the user from assigning an intermediate certificate to a website provided that the certificate got the appropriate usages set.
You need to check the actual certificates. The names "SMA: NS: Web Site certificate" were given to the certificates that could be used to authenticate HTTPS connection to the SMP server, so they are not really "Web Site" certificates, as the SMA does not install the actual Web Site certificate, it only installs intermediate and root certificates. The website certificate comes during HTTPS connection establishment and gets validated on the client machine against the root and intermediate certificates.
So given the above:
And about this assumption:
"Our management has stated the SMP server certificates do not belong in the Intermediate Certification Authorities since they are not Certificate Authorities."
An intermediate certificate is not necessarily a certificate authority, it is just an intermediate certificate, i.e. a certificate used to sign some other end certificate and that is signed itself by another root or intermediate certificate.
In any case, we would suggest to check all the certificates chains in the system, i.e.:
Also, SMA has got certificate backup/restore functionality - SMA checks if all backed up certificates are in the proper stores during each startup and then periodically, that's to eliminate "dead SMA scenario" when a missing certificate prevents SMP Server connection.
You can see all the installed/restored/backed up certificates in the log, you will see their thumbprints.
To remove a certificate backup, the SMATool.exe can be used:
A. stop the SMA service
Find the smatool.exe on your SMP Server in ...\Program Files\Altiris\Notification Server\Bin\Tools and run the following commands from the endpoint machine as needed.
B. smatool /storage enum AgentCore\CertificateBackup - can be used to see which certificates are backed up - you will see the thumbprints
C. smatool /storage delete AgentCore\CertificateBackup - can be used to remove all the backed up certificates or some of them if you specify the exact path
The enumeration command will list every certificate as:
AgentCore\CertificateBackup\2\22cda26b89c13d9c017776c75868b33f97f1df17
The last component of the path is the thumbprint.
\2\ is the store ID where the certificate should be located:
0 - SMA Service Personal store, CEM certs go there
1- Machine store
2- Root store
3. - Client Auth Issuers store
4 - Intermediate store
D. start SMA service, it will not attempt to restore the removed certificates
Just want to mention once again: the certificate chain consists of root certificate, intermediate certificate(s), and SSL certificate. We install root to root certificate authorities, all intermediate certificates to intermediate certificate authorities - this is Microsoft's best practice.
SMA does nothing if certificates are preinstalled.
Questions and Answers:
1. Will prevent WORKGROUP systems without the intermediate certificates from communicating with Altiris?
Answer: It does not matter if the machine is in a workgroup or a domain, certificate usage, and HTTPS connections do not depend on that.
2. Is there a problem with the SMA on a client computer if there is not an intermediate certificate?
Answer: Regarding "systems without the intermediate certificate", If the website is assigned a certificate that has 4 certificates in its chain (1 root + 2 intermediate + 1 web) then 1 root and 2 intermediate certificates must be available on the client, otherwise the certificate chain validation will fail.
i.e. they can remove any expired or not used in any chain certificate but every certificate from a valid chain should remain.
3. When the change on "friendly names like "SMA: NS: Web Site certificate" are not being added anymore by SMA was done?
Answer: These changes were made in 8.5 RU4, see Release Notes.
NOTE: In 8.5 RU3 and earlier, Symantec Management Agent sets friendly names for certificates. Starting from 8.5 RU4, the following changes are introduced: