37

I'm trying to import a certificate to IIS. Everything is ok on the MMC (Windows Console). I finished the wizards and seems that is all right. But, when I refresh the certificate list or move to other screen of IIS, the certificate disappear from the list.

I don't have idea what is the problem. What can I do?

studiohack
  • 305
  • 6
  • 17
  • 1
    Most of the answers cover the key points (that private key is missing), and I have a blog post to reveal more background information https://blog.lextudio.com/the-whole-story-of-server-certificate-disappears-in-iis-7-7-5-8-8-5-10-0-after-installing-it-why-b66e802baa38 – Lex Li Oct 24 '18 at 20:52

14 Answers14

22

This issue happens when the imported cert does not have a private key associated. If someone is trying to import a domain level certificate to IIS, then we cannot import if the certificate does not have a private key associated and will cause certificate disappears on refresh.

Solution would be to import the .CER file to your system(from where certificate is requested) personel store and export it with private key. Then copy the .pfx file to required server and import it from server certificate option under IIS. This would fix the issue.

Sandeep Kalsuri
  • 221
  • 2
  • 3
  • 2
    Some people do not use Windows to request their certificates, so the solution might not help them. They should refer to other answers to generate a .pfx file, with tools like OpenSSL. – Lex Li Oct 24 '18 at 20:53
9

A lot of people will get here not realising that they are doing the certificate process wrongly for adding SSL to their public websites. They will have downloaded a certificate from someone like godaddy and not realised they have done it in the wrong order! They wont get any error messages, all that will happen is that the certificate in IIS will disappear as soon as you click to another section.

The correct process is an follows:

  1. In IIS you request a certificate (A LOF OF PEOPLE ARE MISSING THIS PART)
  2. You use the code requested from IIS to request a certificate on the public site (eg godaddy). A lot of people are not doing step one and are using a randomly generated key
  3. Download the certificates that were created using your request code.
  4. you add the intermediate certificate on in the local certificate authority (use MMC to get there)
  5. You add the other certificate in IIS
  6. You configure the bindings

Here are links. Create certificate request

https://www.instantssl.com/ssl-certificate-support/csr-generation/iis-ssl-certificate-7x.html

https://uk.godaddy.com/help/iis-8-install-a-certificate-4951

Christopher Vickers
  • 191
  • 1
  • 1
5

I have had this problem multiple times. If using a NetworkSolutions SSL the fix is:

  1. Go to MMC Certificate Manager.
  2. View Personal Certificates and delete the certificate that is "Disappearing".
  3. Then view the "Certificate Enrollment Requests" and right click to export.
  4. Select "Yes, export with private key.

This will allow you to export .pfx file that you can import from IIS 7 manager. Remember to go back to MMC Certificate Manager and select "Personal Certificates" and within properties add the "Friendly Name" back in so it shows within the IIS Manager.

Jenny D
  • 27,780
  • 21
  • 75
  • 114
Brian
  • 51
  • 1
  • 1
  • My solution is dragging the Certificates which has private key from "Intermediate certification authority" to "Personal Certificates" in mmc by pressing Ctrl (Copy Cert) – Bruce May 11 '15 at 04:48
  • I was able to export the .pfx, (it asked me to use a password to protect the private key). The export worked, but when I tried importing it into IIS it says that it failed to decrypt the file – Alejandro Lozdziejski Dec 13 '19 at 00:05
3

I had this problem as well and resolved it by using OpenSSL to create the correct .pfx file. Instructions for this can be found here

2

If the server does not have a private key associated for the imported certificate the certificate disappears on refresh (and also it won't be available for bindings).

You can check in the mmc - Certificates - Personal store, and confirm that the certificate was installed but its missing a private key.

If you have a PFX (private key) and password you can import it (as other said), but if you just made a certificate request probably you won't have it.

Supposing that you are on the correct server (the same where you requested the certificate), probably the private key got corrupted somehow. You can open the public certificate, get the serial number, and try to restore the private key from the key store like described here.

drizin
  • 121
  • 5
2

I was having the same issue this morning where I was able to add cert but as soon as I click refresh it was disappearing. Here's How I solved it-:

Use below steps to install ssl cert on dev box-: Use the .pfx file. From your dev box go to Administrative tool-> IIS manager->Server Certificates. Click on Import from the right pane. Browse to the downloaded .pfx file, use password Make sure to check "Allow this certificate to be exported" otherwise If you'd receive bindings error later. Go to Sites, Find your site, click bindings and edit https to use new ssl cert.

Mr. Wonderful
  • 21
  • 1
1

Is this in IIS 6 or IIS 7? Did you import it in the MMC console or in IIS? Try importing it in the MMC console first, and then selecting it in IIS. Also, make sure that the file you are importing is a .pfx file that includes the private key.

Robert
  • 1,575
  • 7
  • 7
1

As Sandeep said, IIS deletes your cert if it does not have a private key. This often occurs if you use IIS to create a Certificate Request from a CA. Your CA does not have your private key (you do) so the file does not contain the private key. He are the exact steps you need to do:

You originally created a Certificate Request from IIS on your Server. You sent the request TXT file to your Certificate Authority so they could create the certificate for you.

Your Certificate Authority sent you back a .CRT file On the same Windows Server you used to create the Certificate Request, In Windows Explorer, right-mouse click on the .CRT file your Certificate Authority sent to you.

Select Install Certificate The Certificate Import Wizard runs

In the Certificate Import Wizard, in Store Location, select Local Machine

Next Select Place all certificates in the following store and select Trusted Root Certificate Authorities

OK This causes Windows to import the certificate into Windows (not into IIS). Now you need to get the PFX file that contains the private key:

Launch Mmc

File - Add/Remove Snap-in…

Certificates (Local Computer)

From Certificates (Local Computer) - expanded Trusted Root Certification

Authorities folder

Selected Certificates

Noticed my imported certificate with a key logo displayed on it

Open the certificate

Notice that it displays "You have a private key that corresponds to this certificate."

Ok

Right-mouse click on the certificate. 

All Tasks --> Export

Next

In the "Export Private Key" page of the wizard, select "Yes, export the private key"

Next

Certificate Export Wizard prompts you -- Export File Format PKCS #12 (.PFX)

Next

Certificate Export Wizard requires you to protect the file with a password:

Enter a password with which to protect the file.

Next

Browse to a location and provide file name. File will have .PFX extension.

Then, Open IIS 7

Select your IIS Server in left (Connections) pane

Click Open Server Certificates in the Features view

From right side "Actions" pane, click Import…

Select the PFX file you exported

Provide the password you used to protect it

Click OK

Martin Cox
  • 11
  • 1
0

Use the cert manager to import the file. From there, try to export. If you can't export as a PFX file, I believe that means there's no private key in the cert. You may have downloaded the wrong one from your CA. I'm dealing with our CA now, so I'm not 100% certain about this yet.

0

So, after struggling with this for a few hours, redownloading the cert spending time on the phone with tech support,and looking at every blog I could find, I was stumped. I tried resubmitting the cert request to regenerate the cert (no luck). With a last ditch effort I regenerated the cert request and rekeyed the cert and now it works fine. I don't know what happened and I was very careful keying in my data both times. My solution was simply to generate a new request and rekey the cert.

  • I just want to second what Dave wrote: rekeying the certificate. I had the problem that was probably caused by importing a wrong certificate in MMC (A certificate of Intermediate Certification Authority is supposed to be imported using MMC, but I imported the certificate for the web site instead). I deleted it after I realized it, but nothing helped until I regenerated a CSR per the instructions of our CA (godaddy which tech support is great) and imported the rekeyed certificate in IIS. –  Aug 22 '10 at 02:47
0

I have the same problem with an IIS cert (w/ private key, .pfx) after importing into the MMC Local/Personal/Certificate node on a Windows server 2008R2 machine.

The cert imports fine, says it's good with CA that is also good. I can then configure my proxy server (TMG 2010) to use the cert in a web listener. Everything works great and the web listener and subsequent rules that use the listener all work fine.

After some time, I haven't tried to time it yet, the cert disappears from the MMC L/P/C node. My TMG listener still shows that cert as being the one it's configured to use, but the actual cert is gone.

0

I've found the problem can be reproduced when the leaf certificate has been installed under Intermediate Certification Authorities. Removing it (and leaving any real intermediate, if applicable) then completing the wizard corrects the problem.

0

Nick Olsen's solution worked for me (RapidSSL certificate) and I will include the exact steps here (there are multiple links, one is broken):

  1. Install OpenSSL from here

  2. Create the following files within OpenSSL installation directory (C:\OpenSSL-Win32\bin by default):

    • privatekey.txt – Copy and paste the private key content
    • certificate.txt – Copy and paste the Certificate section text
    • intermediate.txt – Copy and paste the Intermediate section text (optional step)

  3. Create .pfx file using the following command

    openssl pkcs12 -export -out certificate.pfx -inkey privatekey.txt -in certificate.txt -certfile intermediate.txt

  4. Import the file within the Server Certificates (IIS)

Alexei
  • 202
  • 3
  • 11
0

Process if Certificate is activated.

  1. Login into your Go Daddy VPS via Remote Desktop.
  2. Open IIS Manager/highlight server node(left pane, IP of your VPS)/double click Server Certificates (center pane)/click Create Certificate Request/Fill out (Common Name is a FQDN, yourdomain.com)/choose Microsoft RSA SChannel and 2048 bit length/save as a yourdomain.txt file to the desktop.
  3. Open file yourdomain.txt you just created/Copy all text.
  4. Login to Go Daddy from your browser inside VPS via Remote Desktop/My Products/SSL/Use your activated SSL credit/click center gray square Re-Key and Manage/Paste text into text box/Save/Submit saved Changes.
  5. After owner of Domain is verified go back to Go Daddy/My Products/SSL Certificates/choose the Domain the certificate is applied to/select Server Type (IIS)/Download/extract to Desktop.
  6. Run mmc/File/Add remove Snap-In/Certificates/Add/Computer Account/Local Computer/Finish/OK
  7. Expand Certificates (Local Computer)/right click Intermediate Certificate Authorities/right click/All Tasks/Import/import the file with PKCS7#7 from drop down and that file will display in window/Next/Check "Place all certificates in following store" Select "Intermediate Certificate Authority"/Finish/Close/Save "No"/Close mmc Console.
  8. Go back to IIS Manager/select the website assigned to certificate(left pane)/Bindings (right panel)/Add/Type (https),IP Address (IP of your VPS), Port (443), add your domain name (yourdomain.com)/the certificate should show in drop-down showing yourdomain.com.

Note: I would also check out YouTube/Sachin Sammy on how to do a redirect script from http to https.

seanmac4477
  • 1
  • 1