Failed to set ACM certificate chain (ERR/4)

[shinomen]

I cloned an old laptop Windows install that had the meshagent installed onto a new laptop that supports Intel AMT. The old laptop did not support Intel AMT. Then I was attempting to provision the AMT support on this new laptop. I did my normal CTRL+P to enter setup, changed the p/w, configured user consent to none, then activated the network.

Everything seemed to provision fine and I got a notification in MeshCentral that the laptop was connected via Agent+CIRA. However, the AMT state still showed CCM and it would indeed ask for a p/w to connect KVM. I verified that the AMT setup from CTRL+P was indeed using my p/w I set earlier but no matter what it showed the laptop configured as CCM.

My thought was that maybe I had to use the setup.bin generated from MeshCentral to try and get it to configure in ACM. So I created that file and the system picked it up and configured the AMT using it. Now it shows "Pre" for the AMT State. When I run amtconfig I get the following messages

I have attempted to run meshcmd meshcommander and add the computer using localhost:3000 but I get an authentication error when trying to connect. When trying to browse to localhost:16992 I get the AMT heading with the intel logo but it says "Web browser access to Intel® Active Management Technology is disabled on this computer, or the page in the address bar is unavailable."

Is there anything I can do remotely to get this working again or will I need to go back on-site and do an un-provision an start over?

[si458]

to use ACM with CIRA you need to make sure the domain name in mbex matches the same dns value in your cert in config.json

p.s i always find unprovisioning phyically using the mbex and starting again is the best option

[shinomen]

Hey Simon,
Thanks for the response, you're always so quick! You must have your computer connected to your brain at all times. :)

All my other managed machines work with CIRA in ACM mode (the ones that support it, anyway) so I know that the domain name and cert in config.json are setup correctly. I'll look at unprovisioning this system the next time I'm on-site and trying to get it setup again.
I'm assuming that using setup.bin or manually going in and configuring AMT will provision the system in AMT mode, correct?

[si458]

you can unprovision the AMT remotely using meshcmd directly on the remote machine
meshcmd.exe AmtAcmDeactivate --password PASSWORDHERE --type full
or
meshcmd.exe AmtDeactivate
but this leaves it unprovisioned, so u now only have agent access, so would need to visit the site anyways to re-activate it
OR
try using the USB setup method, and ask remote hands to put the file on a pen and plug it into the pc and restart and it SHOULD auto provision again

P.S: my partner always tell me off for being on my laptop 24/7 haha and i love it more than her haha again