I have a freshly-created Sitecore 9.1 instance.

After setting up the xDB Migration Tool, I get the following error message when running the Troubleshooter:

ERROR [Data Exchange]    at Sitecore.Xdb.Common.Web.Synchronous.SynchronousExtensions.SuspendContextLock[TResult](Func`1 taskFactory)
   at Sitecore.XConnect.Client.XConnectSynchronousExtensions.SuspendContextLock(Func`1 taskFactory)
   at Sitecore.DataExchange.Providers.XConnect.Client.BaseXConnectServiceClientConverter`1.CreateNewClientConfiguration(XConnectClientSettings settings)
   at Sitecore.DataExchange.Providers.XConnect.Client.BaseXConnectServiceClientConverter`1.Convert(XConnectClientSettings settings)
   at Sitecore.DataExchange.Providers.XConnect.DefaultXConnectClientHelperFactory.ToXConnectClient(XConnectClientSettings clientSettings)
   at Sitecore.DataExchange.Providers.XConnect.Troubleshooters.TestXConnectClientEndpointConnection.Troubleshoot(Endpoint endpoint, TroubleshooterContext context)

When I click on "Show Deployed Models" I get the infamous Could not create SSL/TLS secure channel error message, and the stacktrace passes through the same method, Sitecore.Xdb.Common.Web.Synchronous.SynchronousExtensions.SuspendContextLock:

[WebException: The request was aborted: Could not create SSL/TLS secure channel.]
  System.Net.HttpWebRequest.EndGetResponse(IAsyncResult asyncResult) +818
  System.Net.Http.HttpClientHandler.GetResponseCallback(IAsyncResult ar) +83

   [HttpRequestException: An error occurred while sending the request.]
  System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() +31
  System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) +60
  Sitecore.Xdb.Common.Web.<ExecuteAsync>d__41.MoveNext() +950
  System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() +31
  System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) +60
  Sitecore.Xdb.Common.Web.<ExecuteGetAsync>d__36.MoveNext() +597
  System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() +31
  System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) +60
  Sitecore.XConnect.Client.WebApi.<Refresh>d__4.MoveNext() +690

[XdbCollectionUnavailableException: An error occurred while sending the request.]
  Sitecore.Xdb.Common.Web.Synchronous.SynchronousExtensions.SuspendContextLock(Func`1 taskFactory) +518

Which leads me to believe that my first error is, in fact, a TLS one.


Is there a way to troubleshoot TLS connection issues? If I decide to recreate the security certificates in my environment, how can I test that they are working correctly?


This is how the SSL Certificate for my Collection instance is configured:

enter image description here

And this is how the Connection String for XP Collection is configured in my main Sitecore instance:

enter image description here

I have meticulously followed your instructions and exported the following certificate:

enter image description here

to my file system, before importing it in the set of "Trusted Root Certificate Authorities". I also made sure that the Application Pool for my Sitecore website can access that certificate.

I am still getting a 403.16 Forbidden when accessing https://xpscaled910.collection/

This is probably the most obscure and annoying problem I've had to deal with since I started working with Sitecore. Surely they could have provided better documentation?

  • All in one server or is xConnect separate from the CD/CM servers?
    – Chris Auer
    May 20, 2019 at 12:56
  • Separate instances - it's an XP1 configuration. May 20, 2019 at 13:07

2 Answers 2


On your CD server, in your connectionstrings.config. The certificate for xConnect is defined in the xconnect.collection.certificate connection string.

Find that certificate in mmc/certificates. Right click and select Manage Private Keys. Make sure the app pool user for your CD website has read access to the key.

enter image description here

For testing, from you CD server you should be able to open chrome and go right to your xconnect site, https://xconnect.whatever.com/ and see the current date. If you see a cert error in chrome, that would mean you need to install the signing cert for your SSL in your CD server.

enter image description here

Adding a self signed cert to your CD server

On your CD server, open MMC and add in the certificates manager for the local server.

enter image description here

Under personal / certificates you will see you SSL cert. Right click and export the certificate. When prompted say "No. do not export the private key". Select DER as the type and save it to disk.

In Chrome, open settings and search for "Manage Certificates". In the window that pops up, select "Trusted Root Certificate Authorities". Click Import and import the cer certificate you just created. Restart Chrome and you are done. You should get all green from your SSL cert now.

enter image description here

  • I can see the timestamp in IE, but not in Chrome / Brave. Is this alone a symptom of my certificates not being configured correctly? May 20, 2019 at 14:54
  • What do you see in Chrome?
    – Chris Auer
    May 20, 2019 at 15:10
  • HTTP Error 403.16 - Forbidden On IE however, I see the timestamp correctly after accepting the warning. May 20, 2019 at 15:41
  • Is you xconnect https cert a real cert or self signed?
    – Chris Auer
    May 20, 2019 at 15:50
  • 1
    I added steps to import a self signed cert into Chrome.
    – Chris Auer
    May 21, 2019 at 0:48

The problem was that the Sitecore XP Server's Application Pool had no permission to access the


Client Certificate. As it turns out, it was that particular certificate - and not the XPScaled910.collection one - that was being accessed. I found this out by checking the thumbprint used in the "xconnect.collection.certificate" connection string, this corresponded to the XPScaled910.xconnect_client certificate.

I was kind of puzzled by the fact that multiple connection string use that same thumbprint, I then realized that this is the Client Certificate for those servers, which is not the same as the one being used by their own IIS instance.

  • 1
    Every two years, I need to add another upvote to this answer... I would note that on a local machine, you also need to add the Local Service account to the permissions list as well as that's the account usually used by the "Sitecore Marketing Automation Engine" service. Oct 29, 2021 at 13:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.