Issue with Self Signed Cert in WCF - Must have Private Key

Question

I am creating a WCF service hosted within IIS7 on Windows Vista SP1. I am getting the following error:

The certificate 'CN=SignedByLocalHost' must have a private key that is capable of key exchange. The process must have access rights for the private key.

It looks like I would need to give the host process assess to the certificate which was done in the past with winhttpcertcfg which has been deprecated for Vista. The article I found indicates to use the certificate console, but I am missing somethign because I don't see any capability to edit my cert.

Any help would be great!

Thanks

score 8 · Answer 1 · edited Aug 23 '10 at 13:21

8

Figured it out.

Assuming you have a self signed cert at c:\OutCert the following command will work. I had left off the -sky exchange.

makecert -sk SignedByCA -iv c:\OutCert.pvk -n "CN=MyLocalHost" -ic c:\OutCert.cer -sr LocalMachine -ss My -sky exchange pe

Now you can go into the MMC tool and manage the private keys and grant IIS access to the key. To manage private keys, right-click on the certificate and select All Tasks / Manage Private Keys.

edited Aug 23 '10 at 13:21

Roger Lipscombe

89,048
55
235
380

answered Dec 05 '08 at 17:49

JoshBerke

66,142
25
126
164

Explain please - in detail how you go to the MMC tool and manage the private keys? – JL. Nov 16 '09 at 15:55
Where is this All Tasks/Manage Private Keys? I am running Windows 2008 R2, and I don't see that option in the MMC Snap in... – essedbl Mar 15 '11 at 17:45
2

@essedbl: If you right-click on a certificate in the MMC Certificates snap-in, then click on All Tasks, and all you see is Open and Export..., then double-click on the certificate and you won't see any mention of a private key -- there is none attached. Try a certificate in Personal, which says, "You have a private key that corresponds to this certificate" on the General tab, and then try right-click "All Tasks", and you'll see the "Manage Private Keys...". It's only displayed if a private key is there to be managed. – Jim Flood Apr 09 '11 at 03:13
1

If you still don't see "Manage Private Keys...", make sure you're using the 'Computer account' certificate store and not the 'My user account' store when loading the MMC snap-in. – Crackerjack Mar 13 '12 at 17:56
The "Manage Private Keys" option is only found under LocalMachine/StoreName. You won't find it under CurrentUser/.. or Service/.. , at least not in Win7. But once you perform the management, you can then export or copy the certs to other stores (like Currentuser / Service) and it should retain the same rights. – Brian May 03 '13 at 06:51
If your on Windows 7 follow the first answer. – JoshBerke May 06 '13 at 15:49

score 5 · Accepted Answer · answered Aug 09 '11 at 12:06

5

You can use IIS 7.0/7.5 Just Start->Run ->inetmgr Select the server Under "Security" panel, go to "Server Certificates" In the left pane click - "Create Self Signed Certificate" and complete the process The crtfiticate will get installed in LocalMachine StoreLocation under Personal storename. Now use this certificate in your WCF service and you will not face this error

answered Aug 09 '11 at 12:06

Nitin Pande

66
1
1

That's a heck of a lot easier, then my way. My way is the old IIS6 approach – JoshBerke Aug 11 '11 at 15:34

score 0 · Answer 3 · answered Aug 09 '23 at 19:03

If anyone is coming to this question because can't find the "Manage Private Keys" option, the response given by Crackerjack solved it for me:

"make sure you're using the 'Computer account' certificate store and not the 'My user account' store when loading the MMC snap-in"

Issue with Self Signed Cert in WCF - Must have Private Key

3 Answers3

Linked