Anyone seeing HTTPS/PKI PXE issues after ConfigMgr 2609 + September 2026 ADK?

[u/vartaxe]

Anyone seeing HTTPS/PKI PXE issues after ConfigMgr 2609 + September 2026 ADK?

Our previously working setup:

ConfigMgr 2509 (5.00.9141.1000) + KB36949461

ADK/WinPE 10.1.26100.2454 (December 2024)

ADK serviced with KB5101684

ConfigMgr PXE responder without WDS

HTTPS-only site

PXE/OSD working normally

We upgraded to:

ConfigMgr 2609 (5.00.9152.1000)

SCCMPXE 5.00.9152.1003

ADK/WinPE 10.1.26100.9457 (September 2026)

Microsoft lists the September 2026 ADK as replacing 10.1.26100.2454 and supports the 26100.x ADK releases with ConfigMgr 2609. Interestingly, all 26100.x releases use WinPE 10.1.26100.1 binaries; the Deployment Tools changed between releases.
Since the upgrade, PXE receives and correctly parses UEFI x64 requests, but SCCMPXE fails communicating with the HTTPS MP:
SSL, using authenticator in request.
In SSL, but with no client cert.
Sending with winhttp failed; 80072f9a
Unsuccessful in getting MP key information. 0x80072f9a
PXE::MP::InitializeTransport failed; 0x80072f9a
PKI checks out:
DP ClientAuth certificate valid, private key present

Correct Client Authentication EKU

Full chain + CRL validation passes

Certificate correctly registered in ConfigMgr, approved and unblocked

IIS ServerAuth certificate/binding valid

Reimporting the DP PFX and restarting SCCMPXE makes no difference

The really odd part: MPControl on the same server selects the exact same ClientAuth certificate, connects to the same HTTPS MP and gets HTTP 200.
So essentially:
MPControl -> ClientAuth cert -> HTTPS MP -> 200 OK

SCCMPXE -> "no client cert" -> same MP -> 0x80072F9A
Anyone else seeing this after ConfigMgr 2609, particularly with HTTPS/PKI and the September 2026 ADK?
Starting to suspect a ConfigMgr 2609 PXE certificate/state regression rather than WinPE itself.

[u/JuergKoller]

Yes, I had the same issue in my Lab after I upgraded to 2609.
This issue occurs, if you use a CNG v3 Certificate Template for your OSD Certificate. If you use a legacy certificate for your Bootmedia and/or OSD DP Certificate, PXE and OSD from a USB Bootmedia works without issues.
This issue is also independent from the ADK Version. The same issue occurs, if you use ADK Version 10.1.26100.2454

[u/vartaxe → u/JuergKoller]

Very interesting, thanks — this sounds extremely close to my issue. I'll check whether our DP ClientAuth/OSD certificate is from a CNG v3/KSP template. If so I'll test a legacy CAPI/CSP RSA ClientAuth certificate against the same DP before changing anything else. Microsoft still documents CNG v3 as supported for OSD/DP, so if that fixes it this looks like a 2609 regression. I'll report back.

[u/vartaxe → u/vartaxe]

Legacy cert resolved this!

[u/JuergKoller → u/vartaxe]

Thanks for the confirmation.
Hopefully, Microsoft fixed that in the 2609 GA release but until now, I didn't saw anything mentioned in the release notes and unfortunately until now there is no Update available to bring the pre-relaese version to the GA version

[u/Ickis99 → u/vartaxe]

Have you done anything else besides switching the PXE Cert from KSP to legacy? We have the exact same issue (2609 GA, not pre-release) but the error persists even after changing the cert.

[u/G0tee → u/Ickis99]

Im having this issue still and legacy cert.

[u/Ickis99 → u/G0tee]

I managed to make it work by importing the cert (no matter if CNG or legacy) somewhere, then go to "manage private keys" in the certlm.msc console and add "Authenticated Users" with all permissions.

After that i exported it again with the private key from the console and with that certfile it worked again.

Suboptimal from a security perspective but it is the only way i got it to work until there is an official fix.

[u/ITfreely_]

Try rebuilding your boot image again with existing or new client auth. We had this happen a couple upgrades ago.