Hi,
Thanks for coming back to me I appreciate your help.
I have tried importing the .pfx certificate into MMC directly, it won't accept the password. The password is definitely correct, I have done this many times.
Please see the screenshot below.
SSL certificate import issue within IIS on window 2016 server
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(83.2, 19%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMG%3C/text%3E%3C/svg%3E)
Matt Gates
1
Reputation point
Hi, all. Hopefully I'm posting this to the right group.
As of the 19th April we are experiencing problems importing SSL certificates into IIS. We have three 2016 Windows servers and this issue is happening on all three.
We get the error below when importing after adding the password.
Done all the obvious stuff re checking passwords etc.
This has happened now on three separate domain SSL's.
We are using GEO Trust Quick SSL Premium SSL's.
Our hosting company have the same problem when they tried, they don't have a solution either.
We are assuming this might have been caused by a recent Windows update?
Anyone have any ideas or experienced this?
Windows development | Internet Information Services
Windows for business | Windows Server | User experience | Other
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(80, 82%, 17%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBZ%3C/text%3E%3C/svg%3E)
Bruce Zhang-MSFT 3,771 Reputation points2022-04-21T02:00:29.413+00:00 Hi @Matt Gates ,
The image you show cannot provide detailed error message. It just show error occurred but doesn't explain what error it is.
First make sure that the certificate you import is .pfx file not others. Then try to import it through
MMCnot IIS. because a third-party registry sub key exists that prevents IIS from accessing the cryptographic service provider. Please import icertificate to local computer and personal, not only personal.
Sign in to comment
3 answers
Sort by: Most helpful
-
Matt Gates 1 Reputation point
2022-04-21T09:42:10.003+00:00 -
Bruce Zhang-MSFT 3,771 Reputation points
2022-04-22T05:42:40.703+00:00 Hi @Matt Gates ,
How you get the certificate? What I mean is if it is a self-signed certificate, or you get it from any CA provider?
Some certificates have private keys encrypted by AES256 but older versions of Windows do not support it. So please check how you encrypt the password or confirm it with CA provider.
Sign in to comment -
-
Limitless Technology 40,076 Reputation points2022-04-21T10:07:19.077+00:00 Hello MattGates,
This may be related to a change in permissions at the NTFS level on the storage where IIS is installed.
I will recommend you to follow the steps on this troubleshooting guide:
Hope this helps with your query,
----------------------------------------------------------------------------------------------------------------------------
--If the reply is helpful, please Upvote and Accept as answer--
-
Matt Gates 1 Reputation point
2022-04-21T11:26:01.777+00:00 Hi,
Thanks for your answer. This didn't help unfortunately.
We have three 2016 servers all have the same problem trying to import GEO Trust certificates created via our IONOS admin. They import older valid certificates created last month just not new ones created this week.
The new certificates work on our other 2018 windows server. So this seems to be a problem with 2016 windows servers and certificates created this week.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(240, 41%, 33%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ER%3C/text%3E%3C/svg%3E)
Ry 1 Reputation point2022-04-28T10:01:08.343+00:00 Hi MattGates,
Have you found a fix for the problem you described. We have the exact same issue the last week or so.
Like you, ionos is our server host.Older, previously generated pfx files work fine, it is only the new files that are the problem.
In the meantime we have a workaround. The pfx files can be imported to a local windows 10 iis environment, marking them as exportable. you then export a new pfx from the w10 system. The new pfx will then import on the Windows 2016 server prefectly.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(12.8, 26%, 11%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EVH%3C/text%3E%3C/svg%3E)
Vahid Hasani 1 Reputation point2022-06-30T06:12:55.777+00:00 This problem is due to the type of encryption.
If you set type of encryption on AES256-SHA256 when creating the file, you will encounter the wrong password problem in before versions of windows server 2019.
Sign in to comment -