IIS 7 Error "A specified logon session does not exist. It may already have been terminated." when using https

Question

I am trying to create Client Certificates Authentication for my asp.net Website.

In order to create client certificates, I need to create a Certificate Authority first:

makecert.exe -r -n “CN=My Personal CA” -pe -sv MyPersonalCA.pvk -a sha1 -len 2048 -b 01/01/2013 -e 01/01/2023 -cy authority MyPersonalCA.cer

Then, I have to import it to IIS 7, but since it accepts the .pfx format, i convert it first

pvk2pfx.exe -pvk MyPersonalCA.pvk -spc MyPersonalCA.cer -pfx MyPersonalCA.pfx

After importing MyPersonalCA.pfx, I try to add the https site binding to my Web Site and choose the above as SSL Certificate, but I get the following error:

enter image description here

Any suggestions?

score 92 · Answer 1 · answered Sep 15 '14 at 18:54

I ran across this same issue, but fixed it a different way. I believe the account I was using changed from the time I initially attempted to set up the certificate to the time where I returned to finish the work, thus creating the issue. What the issue is, I don't know, but I suspect it has to do with some sort of hash from the current user and that is inconsistent in some scenarios as the user is modified or recreated, etc.

To fix it, I ripped out of both IIS and the Certificates snap-in (for Current User and Local Computer) all references of the certificate in question:

IIS certificates

mmc.exe --> add/remove snap-ins, choose certificates then local computer or current user

Next, I imported the *.pfx file into the certs snap-in in MMC, placing it in the Local Computer\Personal node:

Right-click the Certificates node under Personal (under Local Computer as the root)
All Tasks -> Import
Go through the Wizard to import your *.pfx

From that point, I was able to return to IIS and find it in the Server Certificates. Finally, I went to my site, edited the bindings and selected the correct certificate. It worked because the user was consistent throughout the process.

To the point mentioned in another answer, you shouldn't have to resort to marking it as exportable as that's a major security issue. You're effectively allowing anyone who can get to the box with a similar set of permissions to take your cert with them and import it anywhere else. Obviously that's not optimal.

In my case the problem was that I imported a *.cer file into the certificate store. Make sure to import a *.pfx file into the certificate store. — MarioVW, Mar 18 '16 at 19:04
It seems as though following these steps (rather than importing directly into Server Certificates) brings in the intermediary certs as well, which seems significant. — Katstevens, Jul 11 '16 at 09:34
All I can say is thanks @Mike L -- this is literally the only thing that worked for me. — pim, Mar 16 '17 at 21:00
I used this solution. However, GoDaddy only gave us a *.crt* file for our new certificate, so to extract the private key from the previous certificate (using openssl) and then create a *.pfx* from this (and the *.crt*) and import that. — Jonathan Williams, Aug 22 '18 at 10:13
Adding another possible solution. For me it was because I imported the certificate within IIS instead of from the Windows Certificate Manager. — ryanulit, Feb 06 '20 at 15:33

score 79 · Answer 2 · edited May 23 '17 at 12:26

79

Security warning: what the checkbox really means is that the certificate can be read by users that shouldn't be able to read it. Such as the user running the IIS worker process. In production use the other answer instead.

Happened to me too, and was fixed by ensuring that "Allow this certificate to be exported" is checked when you import it:

enter image description here

(thanks to this post!)

edited May 23 '17 at 12:26

Community

1
1

answered Oct 18 '13 at 14:09

Roman Starkov

59,298
38
251
324

13

Isn't that a security risk? – lanoxx Oct 26 '13 at 22:18
I first had to remove the certificate under the MMC snap-in certificate store "Certificates (Local Computer)/Personal" and the in the same store, I right clicked and selected import and then imported the certificate marking it as exportable. – Jonathan Oliver Dec 15 '13 at 02:26
@lanoxx you still need the password in order to export the certificate, so it's not totally without security. – aboy021 Jan 20 '14 at 01:53
2

@aboy021: No you don't. The password which you enter will be used to encrypt the certificate again, but you can choose any password and it does not need to match the original one that was used to import the certificate. – lanoxx Jan 20 '14 at 14:12
@lanoxx ouch, thanks for clarifying that. Now I just need a way to get this to work without "Allow this certificate to be exported" checked. – aboy021 Jan 20 '14 at 22:52
You also can't grant the IIS Application Pool access to the private key without marking the certificate as exportable – WhiteKnight Aug 18 '14 at 11:43
7

This is a major security risk. Anyone with administrative access can export your private key. Use Mike L's answer instead. – Steven De Kock Dec 16 '14 at 16:52
3

@romkyns You're right, but you'd need third party tools to do it. When the key is exportable, non-administrative users with read permissions (can be managed with MMC) can also export the private key. In this case it would include the IIS worker process ... – Steven De Kock Dec 24 '14 at 14:08

score 11 · Accepted Answer · answered Feb 19 '13 at 11:04

This must be some kind of IIS bug, but I found the solution.

1- Export MyPersonalCA.pfx from IIS.

2- Convert it to .pem:

openssl pkcs12 -in MyPersonalCA.pfx -out MyPersonalCA.pem -nodes

3- Convert it back to .pfx:

openssl pkcs12 -export -in MyPersonalCA.pem -inkey MyPersonalCA.pem -out MyPersonalCA.pfx

4- Import it back to IIS.

score 10 · Answer 4 · answered Aug 17 '15 at 15:42

10

We had the same issue due to incorrectly importing the certificate into the Current User Personal certificate store. Removing it from the Current User Personal store and importing it into the Local Machine Personal certificate store solved the problem.

answered Aug 17 '15 at 15:42

2

I would say this is generally the right answer because it is such an easy mistake to make. If you start the certificate manager using Certmgr.msc you get the personal store rather than the computer store. That means the logons are different. Instead you have to use mmc and then add the snap-in which allows you to select computer store. – OnceUponATimeInTheWest Oct 19 '17 at 09:27

score 7 · Answer 5 · answered Dec 26 '13 at 14:21

Nobody probably cares about this anymore, but I just faced this issue with my IIS 7 website binding. The way I fixed it was going to the Certificate Authority and finding the certificate issued to the server with the issue. I verified the user account that requested the certificate. I Then logged into the IIS server using RDP with that account. I was able to rebind the https protocol using that account only. No exports, reissuing, or extension changing hacks were needed.

score 7 · Answer 6 · answered Jun 07 '16 at 09:26

7

Instead of importing the cert from IIS, do it from MMC. Then goto IIS for binding.

answered Jun 07 '16 at 09:26

Kuldeep Heggana

71
1
1

My issue was that IIS wasn't importing the full certificate chain (i.e. parent cert), but only the child cert. – ErikusMaximus Nov 25 '19 at 20:58
this answer was the easiest solution for me, still not sure what was wrong though. – Etienne Apr 06 '20 at 01:38
This was the answer that sorted the issue out for me. – Steve Aug 23 '22 at 01:09

score 6 · Answer 7 · answered Feb 11 '19 at 10:57

According to the MSDN blog post, this can happen when the current user account doesn't have permission to access the private key file which is under the folder "C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys". Apparently this can be resolved by granting the user account / user group Full Access permission to the above folder.

I've come across the same issue, and was able to resolve it by simply re-importing the .pfx file with the Allow this certificate ti be exported checkbox selected.

However, this method imposes a security risk - as any user who has access to your IIS server will be able to export your certificate with the private key.

In my case, only I have access to my IIS server - therefore it was not a huge risk.

score 5 · Answer 8 · answered Nov 07 '13 at 13:45

In our case this problem occurred because we have installed the certificate in a Virtual Machine and made an image of it for further use.

When creating another VM from the image previously created the certificate sends the message.

To avoid this be sure to install the certificate on every new VM installed.

score 5 · Answer 9 · answered May 07 '20 at 15:52

We found another cause for this. If you are scripting the certificate install using PowerShell and used the Import-PfxCertificate command. This will import the certificate. However, the certificate imported cannot be bound to a website in IIS with the same error as this question mentions. You can list certificates using this command and see why:

certutil -store My

This lists the certificates in your Personal store and you will see this property:

Provider = Microsoft Software Key Storage Provider

This storage provider is a newer CNG provider and is not supported by IIS or .NET. You cannot access the key. Therefore you should use certutil.exe to install certificates in your scripts. Importing using the Certificate Manager MMC snap-in or IIS also works but for scripting, use certutil as follows:

certutil -f -p password -importpfx My .\cert.pfx NoExport

See this article for more information: https://windowsserver.uservoice.com/forums/295065-security-and-assurance/suggestions/18436141-import-pfxcertificate-needs-to-support-legacy-priv

Thanks! This was 1000 times simpler than what I was doing with PowerShell! — Humberto Garza, May 19 '22 at 19:26

user2034250 · Answer 10 · 2015-09-02T11:00:22.310

4

In my case it was because the World Wide Publishing Service user didn't have permissions to the certificate. After installing the certificate, access the certificates module in MMC and right-click the certificate with the issue. Select "Manage Private Keys..." from the "All Tasks" menu and add the above user. This was SYSTEM user in my case.

edited Sep 02 '15 at 11:00

answered Sep 02 '15 at 07:01

user2034250

75
6

score 3 · Answer 11 · answered Jan 20 '14 at 12:45

3

I got this error due to wrong openssl command-line during export PKCS #12 certificate. -certfile key was wrong. I exported certificate again and it was imported successfully.

answered Jan 20 '14 at 12:45

Der_Meister

4,771
2
46
53

score 3 · Answer 12 · answered Jan 07 '21 at 04:02

Guys after trying almost every single solution to no avail i ended up finding my solution to '“A specified logon session does not exist. It may already have been terminated.” when using https" below

Verify your pfx cert is healthy with correct private key
Run certutil and locate the certs 'unique Container name' - i used certutil -v -store my

3.Navigate to C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys and locate the system file that corresponds to your Container name found above

Check permissions and ensure 'system' has full control to file.

Once applied i then checked IIS and was able to apply to https without error

score 2 · Answer 13 · answered Jun 10 '15 at 07:36

I had the same issue. Solved by removing the certificate from de personal store (somebody put in it) and from the webhosting. All done through the IIS manager. Then I added again to the webhosting store (with everything checked) and I can use HTTPS again...

score 2 · Answer 14 · answered May 31 '22 at 16:16

I recieved this error message when trying to use the following powershell command:

(Get-WebBinding -Port 443 -Name
"WebsiteName").AddSslCertificate("<CertificateThumbprint>", "My")

The solution for me was to go into certificate manager and give IIS_IUSRS user permission to see the certificate.

These are the steps I followed:

Move the certificate into [Personal > Certificates]
Right click [All Tasks > Manage Private Keys]
Add the IIS_IUSRS user (which is located on the local computer not in your domain if you're attached to one)
Give read permission

score 2 · Answer 15 · answered Feb 16 '23 at 12:20

Here's what worked for me:

Step 1: Open up a Run window and type "mmc"

Step 2: Click File > Add/Remove Snap In

Step 3: Add > Certificates, Click OK

Step 4: Choose "Computer Account", then "Local Computer" and proceed.

Step 5: Hit OK

Step 6: Right click the Certificates folder on: Console Root > Certificates (Local Computer) > Personal > Certificates

Step 7: Select All Tasks > Import (Please note that the "Local Machine" is selected on the next window)

Step 8: Browse your .pfx file

Step 9: Then go to the IIS and create https binding

score 1 · Answer 16 · answered May 04 '17 at 20:52

I was getting a this error when trying to bind localhost pfx cert for my development machine. Before i tried any of this above, tried something simpler first.

Closed any localhost dev site i had openned.
Stopped my IIS server and closed the manager
run the manager as Admin
Added all my https bindings, no errors or issues this time.
restarted iis

Everything seems to work after that.

score 1 · Answer 17 · answered Sep 16 '20 at 18:29

1

I was getting same error whilst binding the certificate, but fixed after deleting the certificate and importing again through mmc console.

answered Sep 16 '20 at 18:29

Ram

91
4

1

Any explanation to why it fixed would much more helpful – Umang Sep 16 '20 at 23:33

score 1 · Answer 18 · edited Jan 20 '22 at 08:09

In my case, it has been fixed by using certutil -repairstore command. I was getting following error, when trying to add certificate to Web Binding on IIS using powershell:

A specified logon session does not exist. It may already have been terminated.

I fixed it by running:

certutil.exe -repairstore $CertificateStoreName $CertThumbPrint

where CertificateStoreName is store name, and CertThumbPrint is the thumbprint of imported certificate.

score 0 · Answer 19 · answered Sep 22 '15 at 06:18

0

I managed to fix this problem by importing the SSL certificate PFX file using Windows Certificate Manager.

http://windows.microsoft.com/en-us/windows-vista/view-or-manage-your-certificates

answered Sep 22 '15 at 06:18

jorel

808
7
15

EvilDr · Answer 20 · 2016-03-29T09:42:10.087

I just had this issue today and feel compelled to post my solution in the hope that you will lose less hair than I've just done.

After trying the solutions above, we had to re-issue the SSL certificate from the SSL provider (RapidSSL issuing as a reseller for GeoTrust).

There was no cost with this process, just the five minute wait while the confirmation emails (admin@) arrived, and we gained access again.

Once we had the response, we used IIS > Server Certificates to install it. We did not need the MMC snap-in.

https://knowledge.rapidssl.com/support/ssl-certificate-support/index?page=content&id=SO5757

We kept a remote desktop window to the server open throughout, to avoid any issues with differing login accounts/sessions, etc. I do believe it is an IIS bug as another expert believes, as we only have one RDC account. What is most infuriating is that the very same certificate has been working perfectly for two months before suddenly "breaking".

score 0 · Answer 21 · answered Sep 10 '16 at 19:07

In my case I imported a newer version of a certificate (PFX for IIS) from StartSSL just recently and forgot to remove the old one, which somehow caused this error (now two certs sort of the same). I removed both of them, imported the proper one, and now it works.

score 0 · Answer 22 · answered May 02 '21 at 23:22

0

I was able to fix this problem by removing the then importing it by double clicking the certificate.

answered May 02 '21 at 23:22

Wasif Ehsan

9
4

score 0 · Answer 23 · answered Jul 26 '21 at 15:33

For me, the fix was to delete the cert from IIS and re-import it, but into the "personal" certificate store instead of "web hosting"

According to the below, this is fine, at least for my own circumstances.

What's the difference between the Personal and Web Hosting certificate store?

Also, should it make any difference, I imported the certificate via the wizard after double clicking on it on the local machine, instead of via the IIS import method. After this the certificate was available in IIS automatically.

score -1 · Answer 24 · answered Nov 20 '18 at 13:54

-1

Try :

Go into IIS and delete "VSTS Dev Router" web site and "VSTS Dev Router Pool" application pool.
Run “certlm.msc” and open Personal/Certificates
Delete any cert named “*.vsts.me” and "vsts.me"
Re-deploy

answered Nov 20 '18 at 13:54

Vikas Gupta

10,779
4
35
42

IIS 7 Error "A specified logon session does not exist. It may already have been terminated." when using https

24 Answers24

Linked