2

Importing a .pfx-file to IIS using Powershell is pretty straight forward thanks to guidelines such as this one Use PowerShell to install SSL certificate on IIS. But I do run into an issue when trying to bind port 443 using the imported certificate:

Error: "A specified logon session does not exist. It may already have been terminated. (Exception from HRESULT: 0x80070520)".

This due to "...If you don't already have a cer version, or you do but it includes the private key, enable Allow this certificate to be exported..." (ref. Setup of SharePoint 2013 High-Trust On-premise Add-In Developer / Production environment)

This is how it is set in the GUI

enter image description here

But, looking at the following line in the code which I got from dejanstojanovic.net.

pfx.Import($certPath,$certPass,"Exportable,PersistKeySet")

it is set to Exportable. Removing PersistKeyset does not make a difference. So what could causing this?

  1. The script is not able to set it to Exportable as in the GUI "Allow this certificate to be exported"
  2. ...I'm all out of options...

Update

I did tweak the code a bit, using constants and such, but still same issue

$certPath = "D:\ssl\cert-export-to-iis-10.pfx"  
$certPass = "password"  
$pfx = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2  
$KeyStorageFlags =     [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::Exportable -bxor [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::PersistKeySet
$pfx.Import($certPath,$certPass,$KeyStorageFlags)   
$store = New-Object     System.Security.Cryptography.X509Certificates.X509Store("WebHosting","LocalMachine")  
$store.Open([System.Security.Cryptography.X509Certificates.OpenFlags]::ReadWrite)  
$store.Add($pfx) 
$store.Close()   
$store.Dispose()
rhellem
  • 769
  • 1
  • 11
  • 26
  • Have you tried to clear it from both IIS and your certificate store. Then import it into private store. Store.MY? Then go to IIS binding and select the certificate directly? – Jokies Ding Dec 02 '19 at 09:25
  • Tried that now, but made no difference. Did select "WebHosting" since I thought it did _sound_ more correct for my use, but reading https://stackoverflow.com/questions/26681192/whats-the-difference-between-the-personal-and-web-hosting-certificate-store I realize that Personal is the one to use for my scenario – rhellem Dec 02 '19 at 10:45
  • Have you tried to grant administrators group with full control permission to access machinekey. https://blogs.msdn.microsoft.com/kaushal/2012/10/07/error-hresult-0x80070520-when-adding-ssl-binding-in-iis/ – Jokies Ding Dec 03 '19 at 01:33
  • Able to resolve this ever? I am facing same issue. :( – Dev G Apr 28 '20 at 23:02
  • @DevG - No, sorry. Actually I gave up, since using https did require changes to...web.config (?) ... for all applications, so for now still using http://. So https did never become a requirement, my task was only to move apps from Win 2008 to Win 2016, and to ignore the fact that we still not use https :-) – rhellem Apr 30 '20 at 06:05

0 Answers0