Waiting for MCC container to become available

Question

Hi,&nbsp;Trying to setup Intune Connected Cache and getting stuck on MCC Install Waiting for MCC container to become available.running on Server 2022 VM with nested virtulization turned on and using a groupMSA account. I have set this up fine on one of our other domains	enancy.Any ideas? Tried starting from scratch several times and not sure whats stopping it.ThanksScott

scottu1615 · Answer

Yes it was the firewall doing SSL inspection. Removed the SSL inspection and it worked.

serhatsari · Answer

Same issue. Did you solve it ?

christopher_lin · Answer

For future reference, if you are deploying your cache node to a host machine that is behind a TLS/SSL-inspecting proxy (e.g. ZScaler), ensure that you've configured the proxy settings for your cache node, then place the proxy's certificate file (.pem) in the extracted provisioning package directory and add -proxyTlsCertificatePemFileName "mycert.pem" to the provisioning command. This will configure the MCC to successfully operate behind an SSL-inspecting proxy.

More information can be found here: https://learn.microsoft.com/en-us/windows/deployment/do/mcc-ent-deploy-to-windows?tabs=portal#steps-to-deploy-connected-cache-node-to-windows

andrewmcn_sfrs · Answer

I'm experiencing this issue too. Unfortunately, we are also using transparent proxying. It's going to a load balancer and there are two real appliances behind that. The engineers who set them up are using independent certificates. At least, we'd need to offer the MCC deployment process two certificates. Is this possible?

Can we provide the Enterprise intermediates or Root CA instead?

I'm assuming this fatal error is clear confirmation that we are suffering from the decryption issue?

I've tried adding it to a bypass for decryption and authentication, as authentication is another frequent issue with transparent proxies. It didn't appear to improve things. So, I'm not sure if the implementation on the proxy is correct or something else is going on.

When I tried to re-run the MCC deploy script, it now complains that there isn't enough space because it's not smart enough to check for an unfinished deployment.

andrewmcn_sfrs · Answer

I tried feeding it a cert chain of our intermediates and root, but it didn't work. This would have been ideal. Usually works with things like Tomcat.

Trying the decryption bypass again using a different subnet notation within the Cisco SWA involved.

Failing that, I'm going to try a single file with both proxy certs in it. Failing that, I'll try just one and hope for the best.

Forum Discussion

Waiting for MCC container to become available

7 Replies

Resources