I have tried Sitecore 9 update 1 installation on my local Windows 10 and encountered this error:

Exception: Sitecore.XConnect.XdbCollectionUnavailableException
Message: The HTTP response was not successful: Forbidden
Source: Sitecore.Xdb.Common.Web

I found the solution on https://sitecorecorner.com/tag/ssl/ thanks to nsgocev. I removed the non-self signed certificates in Trusted Root Certificates Store and the Sitecore backend was accessible.

However, each time I restart my machine, a new certificate is generated automatically and the error occurs again.

Any suggestion for this kind of issue?

enter image description here

  • Is there a group policy that's automatically installing the certificate? Jun 22 '18 at 14:20
  • It's hard to imagine certs being created automagically, it must be a script somewhere that is doing it. Feb 3 '19 at 1:13
  • are you running as an admin?
    – RG-3
    Mar 4 '19 at 20:04
  • Did you leverage a Desired State Configuration (DSC) at all? A DSC will continue to execute until all conditions are satisfied. If a step is used to install a cert, and that cert is removed, the DSC will add it back again.
    – jrap
    May 21 '19 at 14:20
  • Have you tried moving this Entrust certificate into the Intermediate Certification Authorities store instead? It sounds like something is requiring this certificate as part of its certificate chain and why it's being regenerated when it gets deleted, however, it's still a self-signed certificate. The regeneration could be by group policy or DSC or something, but by moving it to Intermediate Certification Authorities it should fulfill the cert chain AND not be in the trusted root store. Aug 18 '19 at 2:31

Here are some of the troubleshooting tips for this issue

  1. The main cause of this issue could be CM and CD servers are not able to validate the xConnect collection certificates.The SSL certificate installed on CD server has a thumbprint(which can be viewed by going to manage computer certificates) which needs to be verified on the CM instance connection string.config,CD instance connection string.config and all the xConnect instances appsettings.config file and connectionstring.config files.

  2. Move these non-self-signed certificates into the Intermediate Certification Authorities (i.e. CA) store:

    Get-Childitem cert:\LocalMachine\root -Recurse | Where-Object {$_.Issuer -ne $_.Subject} | Move-Item -Destination  Cert:\LocalMachine\CA
  3. Make sure the app pool user has security permissions on corresponding xConnect site.


Try the below powershell script in Windows powershell as admin.

Get-Childitem cert:\LocalMachine\root -Recurse | Where-Object {$.Issuer -ne $.Subject}

Get-Childitem cert:\LocalMachine\root -Recurse | Where-Object {$.Issuer -ne $.Subject} | Move- Item -Destination Cert:\LocalMachine\CA
  • Can you explain what this script is doing and how it solves the issue?
    – Gatogordo
    Apr 11 '20 at 9:16
  • It will show all local certificates and will remove the same.
    – 13luckman
    Apr 11 '20 at 10:22

The Sitecore instance that connects to the xconnect website in your local machine try to follow the below options to solve the issue.

A ) In powershell administrator mode try to run below command to check how many certificate are in trusted root folder .

PS C:\WINDOWS\system32> Get-Childitem cert:\LocalMachine\root -Recurse | Where-Object {$.Issuer -ne $.Subject}

Try to move them to CA

PS C:\WINDOWS\system32> Get-Childitem cert:\LocalMachine\root -Recurse | Where-Object {$.Issuer -ne $.Subject} | Move- Item -Destination Cert:\LocalMachine\CA

B) The self-signed certificate thumbprint is not properly installed so this can block from connecting to xconnect.

C) Type mmc and open your Certificate Store for 'Local Computer'. Right-click your Sitecore certificate > All Tasks > Manage Private Keys. Grant full control to both NETWORK SERVICE and IIS_IUSRS. Do it for both xp0.xconnect and xp0.xconnect_client certificates.

D) In IIS Manager check the certificate is set for xConnect websites. Set the correct certificate from the list for xconnect website.

enter image description here

E) There might be thumprint value mismatched, please check xconnect and sitecore instance website certificate thumbprint value, try to place the correct thumbprint value in the intepub xconnect website App_Config folder appsetting.config , connectionstring.config and also in the sitecore app_config folder's config files . In case you have created a new certificate and their old certificate thumbprint values are present in that result it can show you an unavailable exception.

<add key="validateCertificateThumbprint" value="[CORRECT THUMBPRINT VALUE]" />
<add key="AllowInvalidClientCertificates" value="true" />
<add name="xconnect.collection.certificate" connectionString="StoreName=My;StoreLocation=LocalMachine;FindType=FindByThumbprint;FindValue=[CORRECT THUMBPRINT VALUE]" />

F) Check in the IIS xconnect application pool the identity is set to 'NETWORK SERVICE' also, the xconnect website SSL settings for the content of website or application require SSL checkbox is set to true and client certified is accepted

G) If none of the above options could able to solve the issue then please have a look that if there is any internal/external network setting is applied which might be also blocked TSL/SSL secure channel communication.

  • While this is good information for troubleshooting xConnect certificate errors, the question asked was regarding the regeneration of a certificate in the trusted root store. The OP did say that the Sitecore instance does work without the certificate that was regenerated so this answer does not apply to the question asked. Jul 28 '19 at 13:52
  • @George Chang I also faced the same issue, for me it was the new certificate thumb print value mismatching. Even if also new certificate generation need to check the thumbprint value. I have mentioned other possible reason which could be checked, no reason for downvote other answers without understanding thoroughly.
    – D S
    Jul 28 '19 at 14:39
  • Perhaps you didn't read the question clearly. The certificate that's being regenerated is the Entrust one as shown by OP. OP has also mentioned that the error does not occur if that self-signed Entrust certificate is removed. The thumbprint for xConnect has been shown to be matching based on the instance working correctly without this extra self signed certificate. The answer was downvoted based on not being an answer to the question asked which is about this certificate that is being regenerated and not about the xConnect client authentication certificate. Seems like I understand thoroughly. Jul 28 '19 at 18:43
  • I read it carefully and it is clearly mentioned what was the error, for that I answered, By the way, if you read clearly then what do you mean by OP, Not finding OP. If you understood thoroughly then it would be better if you could answer it first instead of downvote others.
    – D S
    Jul 28 '19 at 19:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.