I have deployed Sitecore 9.0.2 XP Single in an Azure App Service Environment (ASE). After deployment I keep seeing the following error being reported in the log files:

Exception: System.InvalidOperationException
Message: **The certificate was not found**.
Source: Sitecore.Xdb.Common.Web
   at Sitecore.Xdb.Common.Web.CertificateWebRequestHandlerModifier.Process(HttpClientHandler handler)
   at Sitecore.Xdb.Common.Web.CommonWebApiClient`1.CreateRequestHandler()
   at Sitecore.Xdb.Common.Web.CommonWebApiClient`1.CreateClient()
   at System.Lazy`1.CreateValue()
   at System.Lazy`1.LazyInitValue()
   at Sitecore.Xdb.Common.Web.CommonWebApiClient`1.d__37.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Sitecore.Xdb.Common.Web.CommonWebApiClient`1.d__32.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Sitecore.XConnect.Client.WebApi.ConfigurationWebApiClient.d__4.MoveNext()

I used these Quickstart templates that Sitecore provides on Github, and only modified them slightly to allow the use of the ASE.

I generated a self-signed client certificate. In the ARM template parameter file I used the 'allowInvalidClientCertificates' parameter and set it to 'true'. I see that the certifcate has been processed during the installation. The Resource Group contains an object of type Microsoft.Web/certificates. I also see that the Web.config file contains the following line:

<add key="AllowInvalidClientCertificates" value="True" />

The ConnectionStrings.config contains entries listing the certificate thumbprint. As suggested in this stackexchange thread, I added "AllowInvalidClientCertificates=true" to the connection string. But that didn't solve the problem.

<add name="xconnect.collection.certificate" connectionString="StoreName=My;StoreLocation=CurrentUser;FindType=FindByThumbprint;FindValue=DUMMYTHUMBPRINT;AllowInvalidClientCertificates=true" />
<add name="xdb.marketingautomation.operations.client.certificate" connectionString="StoreName=My;StoreLocation=CurrentUser;FindType=FindByThumbprint;FindValue=DUMMYTHUMBPRINT;AllowInvalidClientCertificates=true" />
<add name="xdb.marketingautomation.reporting.client.certificate" connectionString="StoreName=My;StoreLocation=CurrentUser;FindType=FindByThumbprint;FindValue=DUMMYTHUMBPRINT;AllowInvalidClientCertificates=true" />
<add name="xdb.referencedata.client.certificate" connectionString="StoreName=My;StoreLocation=CurrentUser;FindType=FindByThumbprint;FindValue=DUMMYTHUMBPRINT;AllowInvalidClientCertificates=true" />

Any suggestion would be highly appreciated that could lead to a solution. Many thanks in advance.

2 Answers 2


Answering my own question here. Not for points but in case someone else runs into the same problem.

It turns out the error message "The certificate was not found" doesn't refer to the Sitecore client certificate, but refers to the SSL server certificate that was configured on the ASE. Let me explain further.

We deployed an Internal ASE (ILB) and configured it with a non-public Top Level Domain. We also configured a self-signed certificate on the ASE, because you can only request valid 3rd party certificates for public TLD's. Using an SSL certificate from an internal CA wasn't possible, because you cannot simply import the root cert from the CA in a Web App's certificate store, like you do on a Windows server. At least, not that I am aware of.

The SSL certificate you configure on an ASE gets configured on the load balancer of that ASE. All traffic to Web Apps flows through the ASE load balancer. This also applies for Web Apps that communicate which each other that live inside the same ASE. In our situation, Sitecore CD wants to communicate to the xConnect Web App, then hits the load balancer that presents the self-signed SSL certificate. And apparently, Sitecore doesn't like self-signed SSL certificates. And there's no way I found to let Sitecore ignore invalid or invalid certificates, like with a web browser.

The solution was easy. We configured the Web Apps with hostnames (URL's) using a valid TLD and configured a 3rd party issued SSL certificate. As a last step we changed configuration of the ConnectionStrings.config to reflect the new hostnames. That's it. The errors disapeared from the logging and we are able to successfully use xConnect.

  • Hey Richard- Just to clarify, what version Sitecore 9 are you using? I was not aware that Sitecore actually supports ASE. It was something that was revealed with 9.1 Dec 11, 2018 at 19:25
  • 1
    We are using Sitecore 9.0.2. I believe the ASE was already supported. Sitecore support never mentioned that it wasn't supported. They just didn't provide any ARM templates for it. But I could be wrong here. Dec 12, 2018 at 5:48
  • Was told by SC that is was not supported when we were considering it. I know it is possible with modification of ARM templates and I am aware that in external ASE you can actually clone the app service without the use of an ARM template. Supposedly 9.1 is first release that actually supports ASE - I saw it in the release notes, but then it disappeared. Asked SC about why -they told me it will be documented and supported with the next 9.1 update. That is the only reason I mentioned. Regardless, good luck with your solution! Dec 18, 2018 at 23:44

In your Azure Portal, select your web app running the site.

Go to the SSL Settings blade, and in the Private Certificates tab check whether you've got the xConnect client certificate installed there, and whether that thumbprint matches what you have in your config settings.
(If the certificate doesn't show here it needs to be uploaded first)

If that's the case, open the Advanced Tools (should have a link that opens in a new tab), where you can select Debug console -> PowerShell. In the PowerShell console, type

Get-ChildItem -path cert:\CurrentUser\My

See if your certificate appears there.

If that's not the case, go back to your web app, go to Application Settings and add the setting WEBSITE_LOAD_CERTIFICATES with the value of either the thumbprint or (if you have more certificates) the value *: enter image description here

  • The certificate was not listed in the SSL Settings blade, in the Private Certificate tab. So I uploaded it manually. In the Application Settings I changed the value of the WEBSITES_LOAD_CERTIFICATES to * (it listed the thumbprint previously). I restarted the web app after that. However, the certificate doesn't get listed when performing the "Get-ChildItem -path cert:\LocalMachine\My". For some reason the certificate doesn't loaded/imported. Oct 24, 2018 at 19:34
  • That's because it'll not be stored in cert:\LocalMachine\My - that's my bad. It should be stored in cert:\CurrentUser\My - I'll update my answer
    – Trayek
    Oct 25, 2018 at 8:09
  • So are you saying the self-signed client certificate should be listed when performing "Get-ChildItem -path cert:\LocalMachine\My" in Kudu? Because it's not in my case. The cert is listed in the portal under SSL Setings > Private Certificates and shows state healthy. And like I mentioned before, I configured the app setting WEBSITE_LOAD_CERTIFICATES=*. Any idea what I am missing here? Thanks again for the help. Oct 25, 2018 at 8:40
  • 1
    Thanks Trajek for all the help. I have just raised a support ticket with Sitecore and will report the outcome in this thread. Oct 25, 2018 at 13:31
  • 1
    @RichardWaal did you get a response from Sitecore SUpport for this issue? Mar 1, 2019 at 14:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.