Every Configuration Manager site has to decide how clients talk to its management points and distribution points. Plain HTTP has been deprecated since version 2103, which leaves two choices: enhanced HTTP or PKI-based HTTPS. In this deep dive I'll explain what each one protects, which features depend on them (including the cloud management gateway and BitLocker key recovery), and how to check, switch and verify your site.
How it works#
The choice lives on the Communication Security tab of the site's properties, and there are three possible outcomes:
| Mode | What happens | What you manage |
|---|---|---|
| HTTP | Clients talk to IIS-based site systems over plain HTTP. Sites that allow this have been deprecated since version 2103. | Nothing, which is the problem. |
| Enhanced HTTP | The site server issues certificates to management points and distribution points from its own SMS Issuing root, and the management point gives each client a token. Sensitive traffic uses a secure channel; the rest stays HTTP. | Nothing extra: the site generates the certificates. |
| HTTPS only | Clients always use a PKI client certificate with IIS-based site systems, which present PKI web server certificates. | A certification authority, templates, auto-enrollment, CRL availability and renewals. |
Enhanced HTTP is not HTTPS for everything. Microsoft lists functionality that stays on HTTP: client peer-to-peer content, the state migration point, remote tools and the reporting services point, and says the list isn't exhaustive. Its guidance is HTTPS for all communication where you can, and enhanced HTTP where PKI isn't practical, even if no feature you use needs it yet.
The two also mix. Site systems always prefer a PKI certificate, so a management point with a PKI certificate bound in IIS keeps using it after you enable enhanced HTTP, while the others use site-issued certificates.
What depends on it#
| Feature | What it needs |
|---|---|
| Cloud management gateway (CMG) with Microsoft Entra ID or token authentication | Enhanced HTTP on the site, or HTTPS management points. The CMG itself still needs its own server authentication certificate. |
| Co-management for new internet-based devices, including Autopilot into co-management | Enhanced HTTP or HTTPS. |
| BitLocker management key recovery | Enhanced HTTP is supported from version 2103; older versions needed an HTTPS management point. |
| OS deployment without a network access account | Enhanced HTTP lets workgroup and Entra joined devices, boot media and PXE download content securely. |
| Administration service, app approvals by email, recently connected consoles | Enhanced HTTP or HTTPS. |
| User-available apps in Software Center, Company Portal on co-managed devices | Enhanced HTTP (version 2107 and later) or HTTPS. |
Step-by-step#
1. Check what you have today#
- Site: in Administration › Site Configuration › Sites, open the site's properties and the Communication Security tab. HTTPS or HTTP without Use Configuration Manager-generated certificates for HTTP site systems ticked means the site still allows plain HTTP.
- Roles: in Administration › Site Configuration › Servers and Site System Roles, the management point's General tab and the distribution point's Communication tab show HTTP or HTTPS client connections.
- IIS: on a management point, compare the certificate bound to port 443 with the machine's certificates:
netsh http show sslcert
Get-ChildItem Cert:\LocalMachine\My | Format-Table Thumbprint, Issuer, NotAfter -AutoSizeA hash matching a certificate issued by SMS Issuing means enhanced HTTP; a hash matching your CA's web server certificate means PKI.
2. Enable enhanced HTTP#
- On the Communication Security tab, select HTTPS or HTTP and tick Use Configuration Manager-generated certificates for HTTP site systems.
- Leave management points and distribution points on HTTP, and keep Allow clients to connect anonymously off on distribution points.
- Give each management point up to 30 minutes to receive and bind its certificate, and follow progress in
mpcontrol.log. - For scenarios that use Microsoft Entra authentication, onboard the site to Entra ID through cloud attach. Enhanced HTTP itself doesn't require it.
Note: In a hierarchy, enabling it on the central administration site only covers the SMS Provider there. Configure each primary site.
3. Move to HTTPS only#
Order matters, because clients can't use what they can't authenticate to:
- Client certificates first. Issue a Client Authentication certificate to every client, typically from a template based on Workstation Authentication with Group Policy auto-enrollment, and spot-check devices:
PowerShell
Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.EnhancedKeyUsageList.FriendlyName -contains 'Client Authentication' } | Format-Table Subject, Issuer, NotAfter -AutoSize - Web server certificates. Give every IIS-based site system a Server Authentication certificate containing the FQDN clients use, and bind it to the Default Web Site on 443. Software update points are configured separately: to secure scans, configure WSUS for SSL and tick Require SSL communication to the WSUS server.
- Distribution points. Import a client authentication certificate (.pfx) in each distribution point's properties. It authenticates the distribution point to HTTPS management points, and PXE uses it too. Boot media need their own imported certificate.
- Switch roles one at a time, starting with a pilot management point, and confirm clients still check in.
- Finally, select HTTPS only on the site.
Watch out: HTTPS only means clients always use a PKI client certificate with IIS-based site systems. Switch before every domain-joined client has a valid certificate and the ones without lose contact with the site, so you can't use Configuration Manager to fix them.
Verify#
mpcontrol.logon each management point showsSuccessfully performed Management Point availability check against local computerafter the change.- Administration › Security › Certificates lists the SMS Issuing root and the role certificates it issued (enhanced HTTP).
- The management point's HTTPS binding in IIS uses the SMS Role SSL Certificate, or your PKI certificate where one exists.
- On HTTPS clients, the Configuration Manager Control Panel applet shows Client certificate: PKI on the General tab.
- Test the dependent features: an Entra joined device checking in through the CMG, and a BitLocker key escrow (
BitlockerManagementHandler.logon the client).
Tips & gotchas#
- Enable enhanced HTTP now, even if HTTPS is the goal. It's low risk, PKI-bound systems keep their certificates, and features like the administration service benefit straight away.
- Don't oversell it. Remote tools, the state migration point and reporting still use HTTP under enhanced HTTP.
- Watch revocation checking. If Clients check the certificate revocation list (CRL) for site systems is on, the CRL distribution points must be reachable from wherever clients are.
- Track expiry dates. An expired web server certificate on a management point or software update point breaks HTTPS clients.
- Check readiness at scale with CMPivot and Run Scripts before switching anything.
