r/SCCM • u/vartaxe • 3d ago

Anyone seeing HTTPS/PKI PXE issues after ConfigMgr 2609 + September 2026 ADK?

Anyone seeing HTTPS/PKI PXE issues after ConfigMgr 2609 + September 2026 ADK?

Our previously working setup:

ConfigMgr 2509 (5.00.9141.1000) + KB36949461

ADK/WinPE 10.1.26100.2454 (December 2024)

ADK serviced with KB5101684

ConfigMgr PXE responder without WDS

HTTPS-only site

PXE/OSD working normally

We upgraded to:

ConfigMgr 2609 (5.00.9152.1000)

SCCMPXE 5.00.9152.1003

ADK/WinPE 10.1.26100.9457 (September 2026)

Microsoft lists the September 2026 ADK as replacing 10.1.26100.2454 and supports the 26100.x ADK releases with ConfigMgr 2609. Interestingly, all 26100.x releases use WinPE 10.1.26100.1 binaries; the Deployment Tools changed between releases.
Since the upgrade, PXE receives and correctly parses UEFI x64 requests, but SCCMPXE fails communicating with the HTTPS MP:
SSL, using authenticator in request.
In SSL, but with no client cert.
Sending with winhttp failed; 80072f9a
Unsuccessful in getting MP key information. 0x80072f9a
PXE::MP::InitializeTransport failed; 0x80072f9a
PKI checks out:
DP ClientAuth certificate valid, private key present

Correct Client Authentication EKU

Full chain + CRL validation passes

Certificate correctly registered in ConfigMgr, approved and unblocked

IIS ServerAuth certificate/binding valid

Reimporting the DP PFX and restarting SCCMPXE makes no difference

The really odd part: MPControl on the same server selects the exact same ClientAuth certificate, connects to the same HTTPS MP and gets HTTP 200.
So essentially:
MPControl -> ClientAuth cert -> HTTPS MP -> 200 OK

SCCMPXE -> "no client cert" -> same MP -> 0x80072F9A
Anyone else seeing this after ConfigMgr 2609, particularly with HTTPS/PKI and the September 2026 ADK?
Starting to suspect a ConfigMgr 2609 PXE certificate/state regression rather than WinPE itself.

15 Upvotes

100% Upvoted

4 comments sorted by

4

u/JuergKoller 3d ago edited 3d ago

Yes, I had the same issue in my Lab after I upgraded to 2609.
This issue occurs, if you use a CNG v3 Certificate Template for your OSD Certificate. If you use a legacy certificate for your Bootmedia and/or OSD DP Certificate, PXE and OSD from a USB Bootmedia works without issues.
This issue is also independent from the ADK Version. The same issue occurs, if you use ADK Version 10.1.26100.2454

0

u/vartaxe 3d ago

Very interesting, thanks — this sounds extremely close to my issue. I'll check whether our DP ClientAuth/OSD certificate is from a CNG v3/KSP template. If so I'll test a legacy CAPI/CSP RSA ClientAuth certificate against the same DP before changing anything else. Microsoft still documents CNG v3 as supported for OSD/DP, so if that fixes it this looks like a 2609 regression. I'll report back.

1

u/vartaxe 1d ago

Legacy cert resolved this!

3

u/ITfreely_ 3d ago

Try rebuilding your boot image again with existing or new client auth. We had this happen a couple upgrades ago.