Certificate error installing Sitecore Experience Commerce 9.0 u3 using SIF 2.0.0

Question

I'm trying to install Sitecore Experience Commerce 9.0 u3 (already installed Sitecore 9.0 u2) using SIF 2.0.0. I keep getting the following certificate errors:

Creation and startup of the CommerceOps_Sc9 Services web site completed
Creating self-signed certificate for CommerceOps_Sc9
Create new self-signed certificate
Install-SitecoreConfiguration : CertEnroll::CSignerCertificate::Initialize: Cannot find object or property. 0x80092004
(-2146885628 CRYPT_E_NOT_FOUND)
At C:\Program
Files\WindowsPowerShell\Modules\SitecoreInstallFramework\2.0.0\Public\Install-SitecoreConfiguration.ps1:641 char:25
+                         & $entry.Task.Command @paramSet | Out-Default
+                         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Install-SitecoreConfiguration

[TIME] 00:01:46
Install-SitecoreConfiguration : CertEnroll::CSignerCertificate::Initialize: Cannot find object or property. 0x80092004
(-2146885628 CRYPT_E_NOT_FOUND)
At C:\Sitecore\SitecoreExperienceCommerce903\SIF.Sitecore.Commerce.1.4.7\Deploy-Sitecore-Commerce.ps1:80
char:2
+     Install-SitecoreConfiguration @params
+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Install-SitecoreConfiguration

[TIME] 00:02:47
Invoke-ManageCommerceServiceTask : CertEnroll::CSignerCertificate::Initialize: Cannot find object or property.
0x80092004 (-2146885628 CRYPT_E_NOT_FOUND)
At C:\Program
Files\WindowsPowerShell\Modules\SitecoreInstallFramework\2.0.0\Public\Install-SitecoreConfiguration.ps1:641 char:25
+                         & $entry.Task.Command @paramSet | Out-Default
+                         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Invoke-ManageCommerceServiceTask

Answer 1

Export the PFX file of your you root certificate.

Make sure to select Export the private key.

and then Import it again in Personal Certificates

Hopefully it should resolve your issue.

Answer 2

If you go to the <Your Installation Assets Directory>/Configuration/Commerce/CommerceEngine/CommerceEngine.Deploy.json file, then you will notice that installation script is trying to apply the DO_NOT_TRUST_SitecoreRootCert certificate to the CommerceOps_Sc9 site.

Snippet from the configuration.

So now go to windowr+R->type MMC-> Open certificate store by **Add/Remove Snap in** and check if your DO_NOT_TRUST_SitecoreRootCert certificate has little key icon available, as shown by arrow in the screenshot below.

If this key icon is available (which in my case was not available) then follow the steps suggested by the Manish Ramanan in the answer, but if this key icon is not available this means that your certificate has no private key attached. So for this, first you have to bind a private key with your certificate and then you will have to follow Manish Ramanan's answer.

SO, HOW CAN I BIND THE PRIVATE KEY TO MY CERTIFICATE.

1. Open MMC on your computer (you can locate this program by typing “mmc” in your Windows search bar or typing it in the run command).

2. Select “File > Add/Remove Snap-in” (or type Control-M). Select “Certificates” and click the Add button.

3. Select “Computer account” and click Next…

…then direct the snap-in to manage the “Local computer” and click Finish.

4. Click OK to add the snap-in.
5. Next, navigate to the “Certificates (Local Computer) > Personal > Certificates” folder.

6. Double-click to open the certificate, then select the “Details” tab to find and capture the serial number.

Run the certutil Program

7. In order to perform the next step, you will need to open a command line session with administrator privileges. The most straightforward way to do this is to perform a search for “cmd”, then right-click the cmd icon and select “Run as administrator”. (Choose “Yes” if asked if you wish to allow this program to make changes on the computer.)

8. At the command line, enter the following command, using your captured serial number:

   certutil -repairstore my "PLACE_SERIAL_NUMBER_HERE"

Make certain and place the serial number between the quote marks as shown. **It is best to actually type the serial number as the paste function can sometimes lose a character in the cmd window.

9. If successful, this command will return some information about the certificate and a confirmation message.

10. Close the command session and refresh MMC.

Now follow Manish Ramanan's answer to export and import the certificate again in the MMC and then try to run the script again you should not get the error anymore.