14

I need to give access to the IIS user to a pfx certificate. The website is running under the App Pool under some user AppPoolUser. IIS automatically has the user name "IIS APPPOOL\AppPoolUser" and this is what we need to give access when we use aspnet_regiis -ga .

However, when i use winhttpcertcfg to give access to the user "IIS APPPOOL\AppPoolUser", it says "No account information was found".

The command I use is 

winhttpcertcfg -i <filename> -c <certificateLocation> - g -a <account name>

Didn't find any samples for this over the web. Any ideas?

TylerH
  • 20,799
  • 66
  • 75
  • 101
bkhanal
  • 1,400
  • 3
  • 16
  • 24
  • check this http://weblogs.asp.net/hernandl/archive/2005/02/09/WinHttpCertCfgTool.aspx Regards, Vivek – Vivek Nov 05 '09 at 13:21
  • I tried that sample already. My certificate has access to many users now. Pool User, domain admin, everyone ... Looks like the appdomain is running under "LocalSystem" and I dont' see the way to give access to this user as the documentatin says, this is the user with admin access already. – bkhanal Nov 05 '09 at 18:37

7 Answers7

12

I know it's an old question, but I just had the same problem yesterday so I though I'd answer.

I had the same problem but with a certificate located in the LocalMachine -> TrustedPeople store...

You have to use icacls instead of WinHttpCertCfg, taken from this link.

Basically, it should look like this:

ICACLS <filename> /grant "IIS AppPool\DefaultAppPool":R

For the sake of completion, here how I needed to do it to access the "Trusted People" store. Taken in part from this link.

  1. Use the FindPrivateKey tool from Microsoft to locate the actual file for the cert in the store. This tool must be compiled from the source code in .\WF_WCF_Samples\WCF\Setup\FindPrivateKey\CS from the Windows Communication Foundation (WCF) and Windows Workflow Foundation (WF) Samples for .NET Framework 4 download.

    FindPrivateKey.exe TrustedPeople LocalMachine -t "<thumbprint of the SSL cert>"

  2. Use icacls on the file given by FindPrivateKey.

    icacls C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\<path to certificate> /grant "IIS AppPool\<your AppPool name>":R

Voilà!

Robert Koritnik
  • 103,639
  • 52
  • 277
  • 404
dstj
  • 4,800
  • 2
  • 39
  • 61
8

To the original post, you just need to replace the domain "IIS APPPool" with your machine's local domain name - usually the same name as the machine. When WinHttpCertCfg runs, it will turn <MachineName>\<AppPoolUser> into <IIS APPPOOL>\<AppPoolUser>" and grant access to the certficate. If you want to work on a dev desktop with local IIS, this should solve your problem. ICACLS only works on servers (which you will ultimately be deploying to).

Andrew Barber
  • 39,603
  • 20
  • 94
  • 123
Fola
  • 121
  • 2
  • 8
  • +1 Indeed, this worked for me: `winhttpcertcfg.exe -g -c LOCAL_MACHINE\My -s MyCertName -a "MYMACHINENAME\Name Of App Pool"` – Lynn Crumbling Nov 13 '12 at 15:13
  • localhost also works instead of the specific machine name if you want a script that's easier to run on multiple servers – explunit Jun 09 '17 at 14:00
  • 2
    FWIW, I needed to include both the machine name and IIS AppPool, e.g.: `winhttpcertcfg.exe -g -c LOCAL_MACHINE\My -s MyCertName -a "MYMACHINENAME\IIS AppPool\AppPoolUser"` – Scott Mitchell Dec 27 '17 at 17:53
6

You can also do this from the mmc Certificates snap-in.

Just right-click the certificate in question, choose All Tasks -> Manage private keys..., and add the user you want (likely IIS APPPOOL\[your app pool]).

Ben Mosher
  • 13,251
  • 7
  • 69
  • 80
  • 1
    This doesn't appear for me in Windows 7. Wish it did. – Ian Grainger Aug 26 '14 at 11:14
  • IIRC I did all this work under Win7. Working on OSX these days and don't have a Win7 VM handy ATM or I'd look again. Might you not have the private key saved? – Ben Mosher Aug 26 '14 at 11:52
  • Great, I just needed to change the location to my local server, instead the network domain. – Guilherme de Jesus Santos May 22 '15 at 21:06
  • I was unable to actually manage the private keys this way on my work VM. For anyone else having the same difficulty the icacls commandline did work when the UX for adding a user refused to help me in Windows 8.1. – Tim Hardy Dec 15 '15 at 16:00
  • This worked for me in Windows Server 2008 - but only with a kludge. My certificate needs to live in Trusted People, however this menu option doesn't exist when the key is in this location. The kludge is to move the key to Personal, choose All Tasks -> Manage private keys, then move it back again. – nullPainter Mar 07 '17 at 00:09
  • Thanks! I spent 4 hours trying to solve this. I solved it granting rights to IIS_IUSRS because X509CertificateProvider.GetPrivateKey couldn't find the certificate – rasputino Apr 07 '17 at 09:07
6

Update/tl;dr — I've created the CertAdmin module for PowerShell Core to easily get and set certificate permissions.

I was having the same issue:

  • WinHttpCertCfg seems to have been abandoned without a reasonable alternative.
  • My Certificate Manager did not include a "Manage Private Keys" option as mentioned in this old MSDN blog post.
  • Compiling FindPrivateKey is unreasonable overhead in a Windows environment.

Setting the permission for a cert involves granting the application pool the read right to the cert file.

This can be achieved using icacls.exe (the Windows Explorer security UI does not support application pools):

icacls C:\ProgramData\Microsoft\crypto\rsa\machinekeys\9876abcdeblahblahblah /grant "IIS AppPool\AppPoolName:R"

Windows stores machine keys in C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys , but the names of the files are not related to the certificate. The file name for each certificate can be obtained using this PowerShell code:

 ls Cert:\LocalMachine\TrustedPeople |
    select Subject,@{n='FileName';e={$_.PrivateKey.CspKeyContainerInfo.UniqueKeyContainerName}} |
    Format-List

(Change "TrustedPeople" if your cert is in another store.)

The name of the application pool can be obtained from the Application Pools node of the IIS Manager, or by running this PowerShell code:

Import-Module WebAdministration; ls IIS:\AppPools

This PowerShell 3 script will use Out-GridView (ogv) as a GUI pick list for the cert and the app pool, then grant the permission:

ipmo WebAdministration
$cert = (ls Cert:\LocalMachine\TrustedPeople |
    ogv -OutputMode Single -Title "Select Certificate").
    PrivateKey.CspKeyContainerInfo.UniqueKeyContainerName
$app = (ls IIS:\AppPools |
    ogv -OutputMode Single -Title "Select App Pool").Name
icacls $env:ProgramData\Microsoft\crypto\rsa\machinekeys\$cert /grant "IIS AppPool\$($app):R"
brianary
  • 8,996
  • 2
  • 35
  • 29
  • This is great answer because you don't have to use FindPrivateKey - just plain PowerShell. BTW. its a shame that such fundamental, simple op like adding permission is so complicated in Windows. – Andrzej Martyna May 09 '16 at 15:36
3

When you install the application is also adds the documentation:

C:\Program Files (x86)\Windows Resource Kits\Tools

The following examples show some of the ways in which the configuration tool can be used.

This command lists accounts that have access to the private key for the "MyCertificate" certificate in the "Root" certificate store of the LOCAL_MACHINE branch of the registry.

winhttpcertcfg -l -c LOCAL_MACHINE\Root -s MyCertificate

This command grants access to the private key of the "MyCertificate" certificate in the "My" certificate store for the TESTUSER account.

winhttpcertcfg -g -c LOCAL_MACHINE\My -s MyCertificate -a TESTUSER

This command imports a certificate and private key from a PFX file and extends private key access to another account.

winhttpcertcfg -i PFXFile -c LOCAL_MACHINE\My -a IWAM_TESTMACHINE

This command removes access to the private key for the IWAM_TESTMACHINE account with the specified certificate.

winhttpcertcfg -r -c LOCAL_MACHINE\Root -s MyCertificate -a IWAM_TESTMACHINE
Robert
  • 143
  • 2
  • 11
2

If you still want to continue using wihHttpCertCfg, then use the below command:

winhttpcertcfg.exe -i <filename> -c <certificateLocation> -a "ComputerName\IIS APPPOOL\AppPoolName"

I had same issue and I resolved it by above command today.

Dhaval
  • 113
  • 7
0

What works from me is my staging site is in network service (app pool) (deployment) and in my local is "applicationpoolidentity" (working copy)

just change it to applicationpoolidentity and run your winhttpcertcfg command

Joebet
  • 1
  • 1