xConnect returns invalid certificate from website query

Question

Sitecore 9.0 initial release When i go to the sitecore admin backend, i get this error when trying to load xdb information from xconnect:

Exception: System.InvalidOperationException
Message: Ensure definition type did not complete successfully. StatusCode: 401, ReasonPhrase: 'Invalid certificate', Version: 1.1, Content: System.Net.Http.StreamContent, Headers:
{
  Pragma: no-cache
  Cache-Control: no-cache
  Date: Thu, 21 Mar 2019 14:50:13 GMT
  Server: Microsoft-IIS/10.0
  X-AspNet-Version: 4.0.30319
  X-Powered-By: ASP.NET
  Content-Length: 0
  Expires: -1
}
Source: Sitecore.Xdb.Common.Web
   at Sitecore.Xdb.Common.Web.Synchronous.SynchronousExtensions.SuspendContextLock[TResult](Func`1 taskFactory)
   at Sitecore.Analytics.DataAccess.Dictionaries.DataStorage.ReferenceDataClientDictionary.EnsureDefinitionType(String definitionTypeName)
   at Sitecore.Analytics.DataAccess.Dictionaries.DataStorage.ReferenceDataClientDictionary.LoadAs[T](Object key)
   at Sitecore.Analytics.DataAccess.Dictionaries.AverageCounterExtensions.MeasureMilliseconds[T](AverageCounter counter, Func`1 func)
   at Sitecore.Analytics.DataAccess.Dictionaries.ReferenceDataDictionary`2.Get(TKey key, LookupStrategy strategy)
   at Sitecore.Analytics.Lookups.GeoIpManager.GetDataFromDatabase(GeoIpHandle geoIpEntry)

However, when i visit my site https://sos_sc90.xconnect/ it returns no errors for me and seems to be working. I have added the websites application pool permission to the certificate. What am i missing here? I also double checked the thumbprint in connectionstrings.config and in xconnects app settings.

Update 22/03/2019

Just to clarify the steps i took to install the certificates.

I ran this powershell command to install the certificates:

$certParams = @{
    Path = "C:\Development\Sitecore 9.0\xconnect-createcert.json"
    CertificateName = "sos_sc90.xconnect"
}

Install-SitecoreConfiguration @certParams -Verbose

1. Then i went to IIS and selected the new certificate for my xconnect site.
2. I verified that my xConnect site is working (it is showing timestamp).
3. I went to local computer certificates -> personal and granted access to xConnect and Sitecore IIS sites on sos_sc90.xconnect certificate.
4. I copied the thumbprint ID and changed it in the xConnect site AppSettings.config and in Sitecore site ConnectionStrings.config.

Where do i go wrong with this?

Answer 1

I was also struggling with same certificates issue.

It works for me when I relocate xConnect Client and server certificate in personal certificate folder and its root certificate in Trusted Root Certificates folder and remove all unused certificates from folders.

You just cross check that client certificate is in personal certificate folder and make sure that its root certificate is listed in the Trusted Root Certificates.

To remove all non-self-signed certificates from the root store below PowerShell command will identify non-self-signed certificates:

Get-Childitem cert:\LocalMachine\root -Recurse | Where-Object {$.Issuer -ne $.Subject}