Intel vPro Expert Center Blog

Get Going with GoDaddy

steve.f.taylor@intel.com — Tue, 30 Sep 2008 13:15:32 GMT

Going with GoDaddy

GoDaddy is one of the more popular sources for SSL certificates that support remote configuration. But GoDaddy doesn't take security lightly and will do a good bit of homework to validate that you are authorizated to recieve a Deluxe High-Assurance certificate on behalf of your organization. In order to make your purchasing process smooth and successful, here are some tips.

Bill York wrote an excellent blog on how to order such a certificate from GoDaddy that can be found at: http://communities.intel.com/openport/blogs/proexpert/2008/03/03/steps-to-purchase-a-godaddy-certificate-for-the-purpose-of-vpro-remote-configuration. Start by reading this article to familiarize yourself with the technical steps to complete the order. There are some tips below for setting up a new account that you may want to refer to as you start to follow his steps.

GoDaddy performs a good deal of "due diligence" research before they will issue a Deluxe High-Assurance SSL certificate. You can help to ensure the ordering process goes smoothly by anticipating the GoDaddy requirements to facilitate their research.

The "checks" that GoDaddy needs to perform are: domain authorization, corporate document approval, and online and verbal phone verification. You can see the on-going status of these steps when you log into your GoDaddy account after placing your order. As each step is completed, the icon next to that step will change in the Certification Steps Status page, shown below:

Account Setup

But prior to even ordering your SSL certificate, if you have to create a new account, be sure to use your company's formal legal name. GoDaddy will attempt to look up the company in a database, such as your state's list of registered companies maintained by the Secretary of State to see if your company is established. If not found, you may need to supply a letter of authorization from the company on letterhead for "Corporate Documents Approval" (see below).

Also be careful with your company address and phone number. GoDaddy will lookup your company in a online phone directory for the "Corporate Phone Number Found" step. If your business and location are listed with a phone number where you can be reached, you are in good shape since they are going to want to call a published phone number and be transferred to your extension.

If you are in a remote office that is not listed in a directory, be prepared to supply a phone bill in your name where you can be reached instead. Your mobile or home phone may be used if you cannot get a transferred call from an office that resolves to your business in a db like Yellowpages.com or Yellowbook.com. If you know that your address and office number will not be found in an online directory, have a copy of a phone bill (mobile or home) on an account in your name available to fax to them.

When ordering your Deluxe High-Assurance SSL certificate, be sure to follow the instructions from the articles shown above to generate the CSR and specify the appropriate OU to equal "Intel(R) Client Setup Certificate". Once the order is placed, you can start to monitor the status of your order.

Administrative Approval

As soon as you place the order, check the WHOIS lookup for your domain by using the link on the form or another method. Then, call or email your internal administrative contact for the domain to let them know to expect an email from GoDaddy requesting authorization for the certificate. Ask that person in your organization to let you know when they've replied and log back in to check the status after they do. The first three steps, "CSR Being Generated", "WHOIS Lookup Being Performed", and "Awaiting Administrative Approval," should be completed at this point. If not, you may want to call GoDaddy Technical Support to let them know of your progress.

Corporate Document Approval

At that time while you have GoDaddy on the phone, inquire as to whether they can find your company in the Sec. of State database and if not, verify what will substitute for Corporate Document Approval. In some cases, be prepared to submit Articles of Incorporation or copies of a SEC filing at this stage if necessary.

In other cases, you will need to fax a letter that includes the date and CommonName for the certificate signed by the department manager that authorizes you getting the certificate. This manager's position or title will need to be verified through either an on-line directory on your company's web site or by calling your HR department or contact. If you know that person's position or title cannot be verified on-line by GoDaddy, include the phone number for HR in the letter.

Corporate Phone Number Found

At this point, GoDaddy may need to forward your corporate documents to an administrative researcher within GoDaddy and there may be a delay for the documents to be verified. After this is done, and your "Corporate Document Approval" step status changes from In Progress to Completed, you may want to call Technical Support to help them find the best phone number to reach you at in an online directory. If this doesn't work for your phone number, ask for the Request for Verification form that you can complete and fax with the phone bill described above.

Once they have found the right number to call or received your phone bill and Request for Verification form, all that is left is to wait for the call. Verbally verify your identity and soon the certificate will be issued. In some cases, GoDaddy has sent an additional certificate with a P7X file extension, along with instructions on how to install it. I've not seen a case where the installation of this was necessary, and it may only serve to confuse you. You should only need to install the SSL cert for your domain in accordance with the documentation for your management console or provisioning server such as Intel's Setup and Configuration Service (SCS).

Remember, your certificate needs to have a CN matching the domain suffix of the machine where it will be installed and an OU matching "Intel(R) Client Setup Certificate" in the details of the Subject field. Also, the cert will need to "chain up" to the GoDaddy trusted root cert with a thumbprint matching one of the pre-installed trusted root CA thumbprints in the AMT firmware. For more information about certificate format requirements, installation of this cert, and other PKI-related questions regarding remote configuration, as alway,s a good place to look online is here at the vPro Expert Center.

Best of luck in getting going with GoDaddy!

Steps to purchase a GoDaddy Certificate for the purpose of vPro Remote Configuration

william.york@intel.com — Mon, 03 Mar 2008 18:45:59 GMT

The following information contains the detailed steps used to order a Remote Configuration Client Certificate from GoDaddy. There are many methods that can be used, but this was tested and validated that the certificate worked for both SMS and SCCM SP1 to provide Remote Configuration Provisioning to vPro clients.

SUMMARY: You will be required to prove that you, or your company, own the rights to the domain for which you are applying for this certificate. In the following example, I first registered my lab domain before ordering my Remote Configuration Certificate. I also needed a Company representative to submit a letter of approval (Company Letterhead) to GoDaddy giving me authority to request this certificate. I also tested the certificate I received from GoDaddy did work with Remote Configuring AMT clients in SMS and SCCM SP1 environment.

Key items that are detailed in the steps below that were required to get my certificate:

○ Certificate type must be a Deluxe Assurance SSL certificate

○ Certificate request is for an Organization

○ OU = Intel(R) Client Setup Certificate

○ CN = ServerName.domain.com (this must be the FQDN of the Provisioning Server for Remote Configuration generating the CSR)

○ Organization = The legal name of your organization that can approve your certificate request

○ Required Documentation to be submitted (Driver's License, Bank Statement, and Approval Letter on Company Letterhead)

STEPS TO PURCHASE THE REMOTE CONFIGURATION CERTIFICATE

1. Go to GoDaddy Web site: www.godaddy.com

2. Select the SSL Certificate link: https://www.godaddy.com/gdshop/ssl/ssl.asp?ci=8979

3. From the SSL Certificate page, choose the Deluxe SSL certificate and click ADD

a. select Single (your choice of 1, 2, or 3 years) for a single Domain environment

b. Unlimited Subdomains - wild cards are support for version of AMT 2.6 / 3.2 and higher

4. In the next screen, you will be prompted to customize your order. No additional items are necessary on this screen, select Continue

5. At the Checkout Now screen, you should see the Deluxe Assurance SSL certificate (other options may vary if you selected additional items to purchase)

6. In the Billing information Window, make sure to include your valid company name. You will be required to have someone from your company submit an approval letter for this certificate request on company letterhead (more detailed steps to follow).

7. After you fill out your billing information, you will need to login to your account to configure the certificate you have just purchased.

8. After logging in to your account, select Manage SSL Certificates.

9. You will see you have an available credit in the Secure Certificates, Click Set up Certificate link and Click Activate Account

a. You may need to Login in to your account or Create a new Certificate account - this is different than your GoDaddy Account

10. Select the Deluxe High-Assurance SSL Certificate and Click Request Certificate

11. Select Corporate option in Step 1

Fill out Personal Information in Step 2, including your company name

Generate you CSR and paste text in the box provided in Step 3 (make sure to indicate the type of server used to produce CSR)

They provide a link in Step 3 on How to generate a CSR (follow these steps).

The CSR MUST include the following fields to be a valid vPro Remote Configuration Certificate and approved by GoDaddy:

OU = Intel(R) Client Setup Certificate
CN = ServerName.domain.com (this must be the FQDN of the Provisioning Server for Remote Configuration generating the CSR)
Organization = The legal name of your organization that can approve your certificate request

12. After you paste your CSR information and click Submit, your request will be routed to GoDaddy and they will follow up via email for next steps.

13. You will be asked to send them two forms of Identification (Driver License and Bank Statement)

14. Additionally, you will be asked to have someone within your company provide an approval letter on company letterhead stating that you have the authority to request the SSL certificate for this server and domain.

15. After GoDaddy has validated the required documentation, they will send you an email stating that your SSL certificate is available.

16. You can now download your SSL certificate and apply it to your IIS Web Server on your requesting Provisioning Server.

New release of Intel® vPro(tm) Packet Decoder Available for Download

timothy.c.duncan@intel.com — Thu, 28 Feb 2008 21:31:28 GMT

Today we are announcing version 1.0.5.4 of the packet decoder. This version includes some minor bug fixes as well as two important enhancements:

+ Prerelease* support for Intel® AMT Versions 4 & 5

+ Results search & sort

+ Logging

*Due to hardware availability, not all constructs have been tested

These enhancements are in direct response to user requests.

Here's a 5 minute movie on the tool.

We are currently reviewing other user's feedback to determine what the next update will contain and when it will be available. Stay tuned.

DOPD Software Engineering Team

From iCSO SW Engineering – Intel® vPro™ Packet Decoder – The First of Many

timothy.c.duncan@intel.com — Mon, 28 Jan 2008 17:11:15 GMT

Last month's post of the open source packet decoder is just the first of a strong list of tools planned by the team that brings you the Technology Test Utility. The iCSO software engineering team is charted with making utilities and applications available to the public that accelerate and simplify the adoption and activation of Intel vPro technology.

We will be maintaining these tools and look forward to your feedback, suggestions, and participation in making these tools the best they can be for you and the marketplace. Our commitment is to post new versions of each tool at least every other month and of course post earlier if issues are found that render the tool less than useful.

The next tool we will be posting is a Pre-Installation Utility intended to speed the first user experience and automate as much as possible the initial setup of the Intel® AMT(tm) Setup and Configuration (aka SCS) environment in enterprise mode. Coupled with post setup wizards it will enable users to provision devices with minimal effort and time.

We look forward to hearing your feedback on our efforts.

Intel's iCSO Software Engineering Team

... GOT ROI !!! Show us yours...

brian.d.brougham@intel.com — Tue, 11 Dec 2007 20:04:00 GMT

A fellow blogger (Terry Cutler) suggested asking the best group of experts we have on AMT/ vPro about ROI and what you have discovered from the use of this amazing technology in your production environments. I would love to hear from anyone with a proven ROI analysis of their implementation of AMT / vPro.

My hope is you can show how security, power savings, desk side visits, asset inventory, etc have been positively affected as you have activated AMT / vPro. A general background on the environment, your industry vertical, and of the vPro implementation. Post online for all to see and / or send your information to brian.d.brougham@intel.com. The information will be kept confidential, if requested.

Looking forward to the awesome story's, I know are out there... Show us yours!!!!

Brian Brougham

Intel Corporation - Digital Office

vPro Project Team Resources for Success

terry.c.cutler@intel.com — Thu, 04 Oct 2007 21:45:00 GMT

Implementing Intel vPro in a production environment is "easy" in comparison to a major project such as domain migration, email setup\migration, ERP setup\update, or changes due to business acquisition or divestiture. A successful project requires disciplines across IT operations, business processes and governance, project management, client systems management, and understanding of the vPro\AMT technology.

That said - there are a few roles\responsibilities that might help.

Project Sponsor or Champion

The executive or project sponsor with the vision of success, ability to get "buy-in" from others, and has the foresight to navigate internal non-technical challenges.

Project Management

Coordination of resources, schedules, expectations, and so forth. A key role for any successful project, which often has representation both inside and outside a production environment.

Business Process Change Management

Intel vPro extends the reach of client system management with out-of-band capabilities. Understanding the current and future business processes and IT governance is key. Understanding the capabilities of Intel vPro and how it will augment and extend the environment is key. Understanding the desired future state of the environment and associated metrics is paramount.

IT Infrastructure

Intel vPro is focused on the security and manageability of the client systems. It leverages many of the infrastructural capabilities which exist as a foundation to build upon. Understanding the impacts, interactions, troubleshooting, and so forth is important technologically.

Client Systems Management

Understanding the usage models requires some technical experience with the platform. Combined with the roles above, along with the functionality of client system management and Intel vPro technology - this project team role\responsibility is critical.

Principal and Strategic Architects

Individual or team with a holistic understanding of the current and future state of the environment, upcoming technological advances, and so forth. Perhaps a superset of previously stated roles. This role\team assists in making visions become reality.

Agree or disagree? Please share

Intel® AMT Versions and Features

terry.c.cutler@intel.com — Thu, 23 Aug 2007 15:34:00 GMT

Each release of the Intel®

AMT

provides a few additional features. The good news is that Altiris handles the abstraction and interface or capabilities in heterogeneous environments. However, for troubleshooting, deployment, product selection, and other decisions - it may help to provide a summary of features and capabilities within each generation of the platform.

Yet this raises some questions: What version of Intel® AMT is running on the client system? What features does the version support? What are the dependencies on the Intel® Setup and Configuration Service (SCS) for Altiris Out-of-Band provisioning?

All good questions - let's step through each.

What version of Intel® AMT do I have?

Production Intel® AMT systems support either version 2.1 (for Intel® vPro^TM desktop systems) or 2.5 (for Intel® Centrino® Pro systems). First generation Intel® vPro^TM systems were codenamed Averill. First generation Intel® Centrino® Pro systems were codenamed Santa Rosa. Weybridge is the codename of the second generation Intel® vPro^TM desktop platform, and will start with Intel® AMT version 3.0.

If ever a question of what exact version of the MEBx (management engine

BIOS

extension), the login screen will reveal the answer. This screen is typically access via Ctrl-P during the POST boot process. The picture below comes from an Intel® Centrino® Pro systems, running v2.15.15.0000 of the MEBx.

Click to view.

Versions and Features of Intel® AMT

The table below provides a summary of Intel® AMT platform versions and support features. Remote configuration, formerly called Zero Touch Configuration, will be released in September timeframe for Averill and Santa Rosa systems. A future article will address this topic.

Details on Intel® AMT versions beyond that which is stated will be shown later. There is an Intel® AMT 1.0 version, yet not branded as Intel® vPro^TM. Details will not be shared.

A common question is raised of migration paths from one Intel® AMT family to the next. For example - will Averill systems be firmware upgradeable to Weybridge. No. However, the functionality will continue to grow and the capabilities will be integrated into the Altiris console. Thus a mixed environment is supported.

Will you find all these items supported in the current Altiris console for out-of-band manageability? No. This is due to the underlying configuration service and management that is needed, and is presently provided by Intel® SCS. This will be addressed more in the next section. If you happen to download and test the Early Access version of

OOB, RTSI, and RTCI

portals.altiris.com/eap, you will see the additional functionalities.

Does this mean that Santa Rosa systems will not work with the current production environment? In a wired mode, they will perform all of the functions of Averill systems. Some key questions and consideration - Notebooks are powered by AC (wall plug) or DC (battery). In addition, with the wireless network support management of profiles and configurations is needed.

Before continuing to the next sections on power policies and supported states for wired versus wireless environments, a quick review of what hardware asset data is collected might help. See this document for a refresher.

Intel® AMT Power Policies

Adding Intel® AMT to notebooks presents some new possibilities and considerations. The tables below address some permutations of wired vs. wireless, running on AC or DC power, and whether the host system is healthy (e.g. system on and operating system running), sick (e.g. system on yet operating system failed or unavailable), or asleep (whether standby, hibernate, or off). The power states of Intel® are defined in a policy, with nomenclature that might confuse at first. (e.g. S0, S3, S5, and H0 power states). Review mention of power policies and states in .this article

In the case of Intel® Centrino® Pro systems, the power policy is even more extensive. Below is a screen shot of the MEBx menu for power policy. A similar list of options will appear in the Intel® AMT profile.

[this article|http://juice.altiris.com/files/u6338/power_state_policy.jpg]

Click to view.

Intel® AMT over Wired

Since Intel® AMT is on by default and consuming power, if powered by battery it may be better to turn the management engine off. This explains the "No" in the right column of the table below. What about the "No" for system isolation and agent presence is the system the host system is asleep and powered via AC? If the host system is off, what agent or virus outbreak is being prevented? That is why these states are not supported nor needed - they both require the host to be running (not necessarily the host operating system).

Wired mode also assumes the system is connected directly to the management network. If a remote site is connected to the main site via a VPN appliance, this is effectively a virtual extension of the managed network. However, if the target system requires a software agent running above the host operating system to support VPN, this is different and will be addressed in the next section.

Intel® AMT over Wireless

Similar to the last table, the next view addresses Intel® AMT over wireless. The use cases are the same, as are AC or DC selections, and the state of the host system. The key difference is whether Intel® AMT has wireless access. The wired

NIC is on by default and built into the hardware. The wireless NIC actually requires the host system to be on.

Wireless allows mobility, including outside of the managed network. Does this remove the manageability and security of the Intel® AMT platform? If a VPN connection to the managed network requires a Layer 3 (L3) VPN (virtual private network) agent running on top of the host operating system, does out-of-band management still apply?

Technologically, the L3 VPN functionality could be embedded into the Intel® AMT management engine. However, do the variety or vendors and approaches, this presents a major validation and certificate challenge. Plus, the number of potential updates and patches would not be favorable. Therefore, if the system is connected via wireless (or wired) outside of the managed network, and using an L3 VPN agent to connect in - there are some consideration of supported functionality. This does not apply to situations where a VPN appliance is between the Intel® AMT system and the managed network - since that is effectively a virtual extension of the physical managed network.

Intel® AMT 2.5 supports wireless profiles. Thus if the Intel® AMT device is inside a managed environment, connecting via an 802.11 b/g/n network with defined SSID and configurations, the system can be managed out-of-band.

Note: 802.11i, 802.1x, and NAC are supported in the Intel® AMT profile for Centrino® Pro environments. More on this in a latter section
802.11n is draft version today. For best compatibility, use 802.11 b/g networks

With the perceived constraints of Intel® AMT over wireless, does out-of-band still apply? Yes.

If the device is within a managed network environment - whether wireless or wired - and has been configured (e.g. provisioned) correctly, the system is still manageable if the host is on. (e.g. healthy or sick). As mentioned in an earlier tech-tip, system data is still being collected at boot. Plus, if a network filter policy is pushed down to the Intel® AMT device - part of the System Isolation capability (formerly called Circuit Breaker), that policy remains in effect until removed.

If the system is on, yet the host operating system is not functional and the system is inside a managed network environment (whether wired or wireless) - the system is manageable.

The last item may raise some concern - if the system is wireless and host is asleep (S1 through S5 power state), why are all use cases not supported? Remember that the wireless network driver for Intel® AMT requires the host to be on (H0), whether or not the operating system is running. Only the wired NIC is powered in the asleep state - if a connection is available.

Intel® SCS versions

Within the Altiris OOB server install, a service labeled "AMTconfig" is running. The version number of this windows service refers to the Intel® SCS version number. The Altiris Out-of-Band management console (under Provisioning > Configuration Service Settings) will show additional options and capabilities with higher versions of Intel® SCS. Yet what is the relation and mapping of Intel® SCS to Intel® AMT?

The general concept is this: The major version number of Intel® SCS (again - check the AMTconfig service version number) indicates all versions of Intel® AMT supported at or below that number. Therefore, Intel® SCS 3.0 would support AMT 2.0 through 3.0 versions (i.e. Averill, Santa Rosa, and Weybridge). Of course, there are always expections to the rule. Intel® SCS version 1.x supports Intel® AMT 2.1 and below, and Remote Configuration will be supported with a version of Intel® SCS slightly above 3.0. (More on Remote Configuration in a near future article)

The opinions expressed on this site are mine alone and do not necessarily reflect the opinions or strategies of Intel Corporation or its worldwide subsidiaries.

Why SCS (Setup and configuration services)? Some thoughts?

vidya.govindan@intel.com — Thu, 16 Aug 2007 17:47:00 GMT

I am sure you are all aware of the benefits of adopting the embedded manageability features in vPro. What has SCS got to do with that and why do we need SCS?

Can you buy a home theater, plug in the power and expect it to work with all your other media devices? Can you buy a wireless router, switch it on and expect a home network to work without configuring? No.

Similarly, in order to reap the benefits of the embedded manageability features in vPro, we need to set it up and configure it appropriately. Setup and Configuration services (SCS) provide the means to setup and configure vPro systems. Some of the abilities that SCS provides include

- Ability to integrate with identity management systems such as Active Directory
- Ability to request the CA for a certificate on behalf of the vPro system
- Ability to push wireless profiles on to the vPro system for wireless manageability
- Method to push configuration settings to a bulk of vPro systems
- Maintenance operations such as renewal of certificates, re-provisioning systems if hostname changes

Currently SCS is integrated as part of an ISV's management console. With vPro spanning across domains such as Asset management, Remote Support, Security, Patching and Compliance, are we looking at a single management console? If we have different management consoles for different domains, how do we ensure that the vPro systems are setup and configured once and all management consoles can operate with vPro? Who provisions, who maintains, who talks to who in order to make efficient use of vPro in a multi-management console eco system? In order to allow effective inter-operability between the management consoles, are we looking at a "unified provisioning application" for all the technologies that Intel supports on a vPro system?

Let me know your thoughts...