Sitecore 9.0 initial release When I go to the Sitecore admin backend, I get this error when trying to load xDB information from xConnect:

Exception: System.InvalidOperationException
Message: Ensure definition type did not complete successfully. StatusCode: 401, ReasonPhrase: 'Invalid certificate', Version: 1.1, Content: System.Net.Http.StreamContent, Headers:
  Pragma: no-cache
  Cache-Control: no-cache
  Date: Thu, 21 Mar 2019 14:50:13 GMT
  Server: Microsoft-IIS/10.0
  X-AspNet-Version: 4.0.30319
  X-Powered-By: ASP.NET
  Content-Length: 0
  Expires: -1
Source: Sitecore.Xdb.Common.Web
   at Sitecore.Xdb.Common.Web.Synchronous.SynchronousExtensions.SuspendContextLock[TResult](Func`1 taskFactory)
   at Sitecore.Analytics.DataAccess.Dictionaries.DataStorage.ReferenceDataClientDictionary.EnsureDefinitionType(String definitionTypeName)
   at Sitecore.Analytics.DataAccess.Dictionaries.DataStorage.ReferenceDataClientDictionary.LoadAs[T](Object key)
   at Sitecore.Analytics.DataAccess.Dictionaries.AverageCounterExtensions.MeasureMilliseconds[T](AverageCounter counter, Func`1 func)
   at Sitecore.Analytics.DataAccess.Dictionaries.ReferenceDataDictionary`2.Get(TKey key, LookupStrategy strategy)
   at Sitecore.Analytics.Lookups.GeoIpManager.GetDataFromDatabase(GeoIpHandle geoIpEntry)

However, when I visit my site https://sos_sc90.xconnect/ it returns no errors for me and seems to be working.

I have added the websites application pool permission to the certificate. What am I missing here? I also double-checked the thumbprint in connectionstrings.config and in xConnect app settings.

Update 22/03/2019

Just to clarify the steps I took to install the certificates.

I ran this PowerShell command to install the certificates:

$certParams = @{
    Path = "C:\Development\Sitecore 9.0\xconnect-createcert.json"
    CertificateName = "sos_sc90.xconnect"

Install-SitecoreConfiguration @certParams -Verbose
  1. Then I went to IIS and selected the new certificate for my xConnect site.
  2. I verified that my xConnect site is working (it is showing timestamp).
  3. I went to local computer certificates -> personal and granted access to xConnect and Sitecore IIS sites on sos_sc90.xconnect certificate.
  4. I copied the thumbprint ID and changed it in the xConnect site AppSettings.config and in Sitecore site ConnectionStrings.config.

Where do I go wrong with this?

  • I had similar issues. For me, it was because when the certificates where created, I inadvertently used a different root certificate. I'd double check your certificate chain to make sure that it is part of same root certificate and that the root certificate is listed in the Trusted Root Certificates
    – Mikeyp
    Mar 21, 2019 at 15:14
  • 1
    Did you change your app pool user? You might be getting access denied to the xconnect certificate.
    – Chris Auer
    Mar 21, 2019 at 15:26
  • I used dotPeek to debug an xconnect issue, blogged about it blog.gravypower.net/2019/02/27/the-certificate-was-not-found it might help you debug your issue.
    – Gravypower
    Mar 21, 2019 at 21:48
  • @Mikeyp that root certificate is in my personal -> certificates folder. i moved it to trusted root certification authorities and try again.
    – mp1990
    Mar 22, 2019 at 7:26
  • It's possible that one of the old thumbprint references was missed. This is particularly important if you run into such issues if you have a more complex infrastructure setup. This post may help you with anything else you may have missed: sitecore.marcelgruber.ca/posts/… Mar 2, 2023 at 15:40

1 Answer 1


I was also struggling with the same certificates issue.

It works for me when I relocate the xConnect Client and server certificate in the personal certificate folder and its root certificate in Trusted Root Certificates folder and remove all unused certificates from folders.

You just cross-check that the client certificate is in the personal certificate folder and make sure that its root certificate is listed in the Trusted Root Certificates.

To remove all non-self-signed certificates from the root store below PowerShell command will identify non-self-signed certificates:

Get-Childitem cert:\LocalMachine\root -Recurse | 
    Where-Object {$_.Issuer -ne $_.Subject}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.