I am sure you checked these, but I’ll list these off as items that I have seen missed in the past.

1. Make sure the cert chain is installed on the GW under local computer\>Certificates>Trusted Root Certification>Certificates and not under Current User. This can cause the problem right away.
2. Is the GW in a domain or workgroup?
3. Make sure the FQDN of the GW is the servername.gwdomain.com. If this is a workgroup, then a GW really wont help you here. However the FQDN would only be the server name with no FQDN
4. What OS is the Gateway? And what CSP are you using in your Cert template?
If this is 2003 and up you should be using MS RSA SChannel Cryptographic Provider.
5. make sure the cert is in the reg on the gw at HKLM\Software\Microsoft\Microsoft Operations Manager\3.0\Machine Settings\ChannelCertificateSerialNumber

Let me know if this helps or not
Brad

Thanks for the detailed info. It has been really useful. However I couldn’t get it to work and would appreciate your help.

I created two certificates with FQDN for gateway and RMS. I imported both of them to both gateway and RMS by cert import GUI and MomCertImport. I ran the gw approval tool as well and can now see the gw in SCOM console under management servers.

However, the gw still cannot connect to the RMS and there are 20057, 21001 and 21016 errors in the event log. I requested and checked the ports and they are open. Any suggestions?

PS: One thing I am not sure about is that do I need to import both RMS and gw certs to the gw? Or only the gw certificate?

Thanks for your help..

Sorry about the delay, just getting back from vacation. Have you found a solution to this yet?

Is the reporting server and DW in the same cluster?

“and removal of the old RMS when you do this” I bit of a typo with poor crammer. When you promote the MS to RMS. You also need to make sure you have confirmed that the RMS is completely removed from SCOM before you can promote it again.

Hopefully your are already healthy, let me know if you want to discuss this more.

Brad

I made the unenviable mistake of desinstalling Scom on the passive node of our RMS cluster. I tried reinstalling but the rms key must have been stale. Then I couldn’t connect to the Scom console when either clustered node was the RMS cluster.

So, I ran the msiexec.exe /i CREATE_NEWKEY=1

I could then connect to the Scom console and see alerts in the console but emailing and paging seems to be broken.

One of the clustered management servers is grey in under “management server” and listed as an RMS. Clearly this is a bad sign.

So, with that said do we need to promote a management server to the RMS. Then deinstall Scom on both RMS. Reinstall and create the cluster resources.

And promote the cluster virtual name. Your last note says: “and removal of the old RMS when you do this”. What does that mean?

If you have exact instructions, that would be great, since I’m not feeling lucky lately.

Thanks,
Paul

You will have the chance to change the path when you re-attach the database. At this point the wizard will place all your DB files into that location. If you have a test environment, you should run through once as well. Even if you don’t have a test server with a SAN, it would still be helpful for you to go through the process of moving the database itself.

However, not being a SQL guy myself don’t take this as the right approach. But if you are planning on using the same drive letters for your SAN attached drive. Then you may not need to detach and reattach the database. You might be able to simply stop your sql services, copy the database over to the new drive, change the drive letters on the SAN drive to match the original. And restart the database.

Let me know what you do, I am curious.

Brad

If I understand your question to be “Can you use the IPSEc offline cert instead of a custom OpsMgr cert?”

I would say no. There are OID’s that need to be part of the certificate. So in this case you will need to create it.

I have not used 2008 R2 CA yet for Opsmgr. But yes, you can use this. I have seen many blogs as well that discuss this.

Hope this helps,
Brad