"CA证书指纹无法验证。“尝试启动在Android和Intune上注册SCEP证书的过程

Question

晚上好。

所以，我的问题是:我负责设置所有的NDES基础设施，为Intune注册的Android设备提供SCEP证书。

在详尽地介绍了基础结构中的所有安装/配置步骤之后，我的测试设备根本无法注册证书。

那么，我想问一下，是否还有其他人发现了同样的问题，可以给我一个提示:错误可能是什么？

`

2022-10-30T15:52:01.2350000 VERB    org.jscep.client.Client 25727   03516   Requesting certificate verification.
2022-10-30T15:52:01.6350000 INFO    com.microsoft.intune.omadm.cryptography.androidapicomponent.abstraction.GetCertificateChainUseCase  25727   03516   Certificate chain built with length 1, rootIssuerFound = true
2022-10-30T15:52:01.6370000 VERB    org.jscep.client.Client 25727   03516   Certificate verification failed.
2022-10-30T15:52:01.6380000 ERR_    com.microsoft.omadm.platforms.android.certmgr.CertificateRequestHandler 25727   03516   Enrollment request failed
    org.jscep.client.ClientException: CA certificate fingerprint could not be verified.
        org.jscep.client.Client.verifyCA(:752)
        org.jscep.client.Client.getCaCertificate(:282)
        org.jscep.client.Client.getEncoder(:699)
        org.jscep.client.Client.enrol(:623)
        com.microsoft.omadm.platforms.android.certmgr.CertificateRequestHandler.enrollCertificate(:181)
        com.microsoft.omadm.platforms.android.certmgr.CertificateRequestHandler.processRequest(:123)
        com.microsoft.omadm.platforms.android.certmgr.CertificateEnrollmentManager.tryEnrollCertificate(:123)
        com.microsoft.omadm.platforms.android.certmgr.CertificateEnrollmentManager.enrollPendingCertificates(:205)
        com.microsoft.omadm.platforms.android.provider.CertificateEnrollmentProvider$CertificateRequestPolicy.enforce(:400)
        com.microsoft.omadm.client.tasks.TemporaryOMADMClientExecutorTask.checkComplianceAndEnforceForUser(:915)
        com.microsoft.omadm.client.tasks.TemporaryOMADMClientExecutorTask.updatePolicyForUser(:805)
        com.microsoft.omadm.client.tasks.TemporaryOMADMClientExecutorTask.updatePolicy(:1278)
        com.microsoft.omadm.client.tasks.TemporaryOMADMClientExecutorTask.run(:255)
        com.microsoft.omadm.taskexecutor.TaskExecutor$InternalExecutorRunner.run(:322)
        java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:462)
        java.util.concurrent.FutureTask.run(FutureTask.java:266)
        java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167)
        java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641)
        java.lang.Thread.run(Thread.java:923)

`

Intune没有给出任何提示，但是我成功地恢复了测试设备日志，主要的日志错误是"CA证书指纹无法验证“。下面是错误的一部分。

Answer 1

通过删除信任存储中未使用的证书来修正。