2

I have a pretty straight forward setup: IIS 8 on Windows Server 2012 R2 2x ARR servers with NLB 3x Web content servers in a web farm

ARR servers have IIS shared configuration and IIS web content servers have shared configuration. I am able to sucessfully browse to a domain pointed to my ARR NLB IP over HTTP and hit my web servers in the web farm.

My problem is when I add certificates to the CCS share, they show up with a red X and the error "the specified private key password is not correct.". I have no key password specified in the CCS feature settings, and I generated a CSR and key without encryption to issue these test certificates from a valid CA.

The CSR and key's are all generated through a custom internal SSL utility which is just using OpenSSL. I ran the certificate and key through some validation tools on sslshopper.com and they verified to match and the key was able to be read as it was not encrypted.

I generated the PKCS#12 (.pfx) file using OpenSSL with my un-encrypted key and certificate issued from my CA. I am able to import the generated PFX into my cert store on my local machine, view it, and export it all without issue. Once strange thing I noticed is that when I exported the cert with key from my personal cert store on my machine and added it to the CCS, the error was that the file system could not find the file specified, even though it's displaying the cert with an error which is located in the share.

Any assistance would be greatly appreciated.

Image of error

Shadow00Caster
  • 384
  • 1
  • 4
  • 15
  • An other solution might be to create your pfx certificate using OpenSSL under Linux. – Ach Oct 29 '18 at 13:02

3 Answers3

2

In regards to the issue you are seeing where it responds with the file system could not find the file specified, we had a similar issue.

Our certificate manager always uses Linux/OpenSSL to create the PFX files, and the output file have missing header information that OpenSSL doesn't care about. The fix for us was to import the cert into CertMgr.msc on Windows and then re-export it to a new PFX; once imported into the CCS, all worked as it should.

SmithPlatts
  • 121
  • 4
  • You are importing the generated PKCS#12 from OpenSSL into CertMgr and then exporting? When I do that, I still get the file system cannot find the file specified. – Shadow00Caster Feb 24 '16 at 20:17
  • This method works IF you import into LOCAL MACHINE store. Do NOT use CURRENT USER store when importing. I suspect that the MachineKeySet flag needs to be set on the SSL certificate, and importing into LOCAL MACHINE store does this automatically, and exporting keeps the MachineKeySet flag. – Grant Jul 09 '17 at 01:24
1

I had the exact error today on IIS Windows Server 2016. After some searching I found the answer. It seems there are issues with impersonation when using IIS Manager GUI and the Centralized Certificate Store. I was logged in with my normal domain admin account but had configured the certificate store network share to be mounted as a different account (which had sufficient rights). I changed everything to Administrator, logged in as Administrator and everything worked. Evidently it's only a problem with the GUI but in this case it was pretty misleading. See this thread for more info: https://github.com/ridercz/AutoACME/issues/14

George Carey
  • 11
  • 1
0

Even attempting SmithPlatts recommendation, I was still unable to get CCS to recognize the certificate.

I ended up generating a request from IIS, completing the request with a CA provided cert, and then exporting that certificate with key from certmgr. I took that PFX and CCS see's it no problem.

I don't know exactly what the problem is, I suspect it is something along the lines of SmithPlatts post, but unsure. I plan to make some PowerShell scripts to manage this process, not ideal, but it works.

Shadow00Caster
  • 384
  • 1
  • 4
  • 15
  • How frustrating! Sorry that my suggestion didn't seem to help. I remember we had to do a lot of fussing about to get it to work when OpenSSL was used; but I'm 99% sure that importing to CertMgr, and re-exporting (with private key and full chain) worked for us. – SmithPlatts Feb 25 '16 at 09:56
  • Ah, finally found the link to some information about using non-Windows means to create properly formed CCS-supported certs: http://www.cisco.com/c/en/us/td/docs/app_ntwk_services/data_center_app_services/css11500series/v8-10/configuration/ssl/guide/sslgd/certkeys.html#wp999076 – SmithPlatts Feb 25 '16 at 10:01