Could not establish trust relationship for the SSL/TLS secure channel after Hotfix KB36495448 & KB36419072

[mnagyLAGB]

After installing Configuration Manager 2509 KB36495448 & KB36419072, Invoke-CMApplyDriverPackage.ps1 fails in a deployment task under WinPE with the following errors:

• The remote AdminService endpoint certificate is invalid according to the validation procedure. Error message: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel.
• Will attempt to set the current session to ignore self-signed certificates and retry AdminService endpoint connection
• Failed to retrieve available package items from AdminService endpoint. Error message: The remote server returned an error: (404) Not Found.
• An error occurred while calling AdminService for a list of available driver packages. Error message: InnerTerminatingFailure
  The Task Sequence Variable MDM UserName was adjusted beforehand domain.com\username and it worked without the hotfixes.

[Iboo1995]

Hey @mnagyLAGB , did you find a solution for this issue?

[mnagyLAGB]

Hello, no, not yet. I've switched to the MECM standard driver installation method for now.

[TheCaptainGizmo]

I ran into the same issue and found that it was related to the format of the account used for the Admin Service in the task sequence.
Switching from Domain\UserName to Domain.com\UserName fixed it.

So, change from: Domain\UserName
To: Domain.com\UserName

[Iboo1995]

Hi @TheCaptainGizmo I can agree to that, it fixed my issue.
@mnagyLAGB I am on the latest patch + Hotfix(es) 2509 and it worked - give it a try.

Cheers.

[mnagyLAGB]

Hi, I made the change to To: Domain.com\UserName immediately after update 2509. That worked again. The problem reappeared for me immediately after KB36495448 and KB36419072. It no longer works in my environment.

[M-Vinberg]

Hi, I had same issue after updating to 2509 and KB36495448 and KB36419072. I tested domain.com\username, username@domain.com with no luck. I ended up with hard coding username and password in the script and then it started to work again. I know it´s far from the best way but at least it is working again so we have time to troubleshoot further for a solution.

If someone want to give it a try look for row 634 and 665 in function test-adminservicedata. I used domain.com@username format

[Twisty25204]

For info, had the exact same issue post 2509 and the same fix. putting the FQDN for the domain resolved the issue. I will not be applying the hotfixes unless absolutely needed by the environment if people are saying the issue comes back.

[SPatrickStevens]

2509 with both hotfixes installed here in my lab. I had not run a device through OSD in who knows how long. With the release of the new Driver Automation Tool, I wanted to do some testing and ran into this issue.

Had to switch from SVC_CM_AS@domain.com to corp.domain.com\SVC_CM_AS

During my troubleshooting, I removed one special character from the password per one of the recommendations above with no change. I added it back after successfully testing the username format above, and confirmed everything still works.

[KVNJSU]

We are having the same issue, tried both domain.abc.com\username and also username@domain.abc.com and nothing works. We are already on 2603.