Remote Configuration Certificate Requirements; Remote Configuration Certificate - Differences Between Releases - Symantec ALTIRIS OUT OF BAND MANAGEMENT COMPONENT 7.0 SP3 - IMPLEMENTATION GUIDE V1.0 Implementation Manual

182 Reference topics

Remote Configuration certificate requirements

Remote Configuration certificate requirements
Remote Configuration certificate – differences
between releases
Cleans up exported USB keys files older than 7 days.
Using Microsoft certification authority, which you must have installed to use the
remote configuration feature, and the certificate, you configure Intel SCS to be
able to establish a secure connection between Intel SCS and the Intel AMT device.
The following are the certificate requirements for remote configuration use:
The OID in the Extended Key Usage box must be a Server Authentication
Certificate with an Intel setup extension:
1.3.6.1.5.5.7.3.1,2.16.840.1.113741.1.2.3
or the OU value in the Subject box must be
Intel(R) Client Setup Certificate
The Subject CN must be either the FQDN of the platform running the service
(Example: provisionserver.west.yourenterprise.com), or the domain suffix of
the platform: for example, *.west.yourenterprise.com or *.yourenterprise.com.
The keys should be exportable to support IT key backup policies.
The request type should be PKCS10.
See "Initializing Intel AMT computers using the Remote Configuration feature"
on page 65.
Intel AMT validates the SCS certificate by comparing a domain suffix or FQDN
against the CN in the certificate. Different Intel AMT releases perform this
comparison differently. This can have an impact on the certificate that an
organization acquires. An Intel SCS installation that sets up platforms with a mix
of Intel AMT releases needs to acquire a certificate that is appropriate for all the
versions that will be configured.
See "Intel AMT Release 2.2"
See "Intel AMT Release 3.0"
See "Intel AMT Release 2.6"
on page 183.
on page 183.
on page 183.