2

While I'm installing Sitecore 9.2.0 rev. 002893. I've reached step 29 where an error occurs:

[------------------------------------------------------------------------------------------ ImportRootCert : ImportPfxCertificate ------------------------------------------------------------------------------------]
Install-SitecoreConfiguration : The PFX file you are trying to import requires either a different password or membership in an Active Directory principal to which it is protected.
At ******************\Install-XP1-Distributed.ps1:209 char:1
+ Install-SitecoreConfiguration @DistributedDeploymentParams -Verbose * ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Install-SitecoreConfiguration

[TIME] 00:05:32

In C:\certificates there are 3 pfk files created:

  • SitecoreRootCert.pfx

  • SERVER_DNS.pfx

  • DEFINED_PREFIX.xconnect.pfx

Each *.pfk file can be imported manually with passwords that are visible in a log file for each certificate.

I'm using windows admin user. I'm running Install-XP1-Distributed.ps1 script from the official installer. I populated the required variables.

Is there any configuration option I need to set/remove to resolve this?

If more info is needed I will provide it, just let me know.

Thanks in advance.

Improve this question
2
  • What is the version of your OS? You can check it running winver command in Run app.
    – Alessandro Faniuolo
    Feb 7 '20 at 14:26
  • Hi Alessandro, I'm using Windows Server 2016 Standard, Version 1607.
    – Radovan Jelicin
    Feb 8 '20 at 20:14
1

There are different versions of the Import-PfxCertificate and the Export-PfxCertificate cmdlets. The versions that come with Windows Server 2016 and Windows 10 1703 and earlier do not support importing a PFX generated using the AES256_SHA256 cryptographic algorithm and result in the error that you experienced.

This issue doesn't occur with the version of these cmdlets that come in Windows Server 2016 1709 and Windows 10 1709 and newer, when using the AES256_SHA256 cryptographic algorithm.

You can probably avoid this issue, installing the required certificates on each server manually and then specify the correct certificates to use in the installation input parameters. This is the same process to follow when using signed certificates for a production setup, as described in the official Sitecore installation guide.

Improve this answer
5
  • Hi Allesandro, thank you foe your quick response. This is production environment and fresh installation of Sitecore. Certificates (pfx files) are created by installation script itself. Ok, I have few options on my plate for now, I will also check if windows update is option and I will share solution. Thank you once again.
    – Radovan Jelicin
    Feb 10 '20 at 7:34
  • Well, this can not be solution here. We have test environment working which is on Windows Server 2016 (below 1703) and no issues there. So I will need to find solution or workaround for this.
    – Radovan Jelicin
    Feb 13 '20 at 10:49
  • Are all your production servers on the same OS version, including the additional server from where you run the distributed installation command?
    – Alessandro Faniuolo
    Feb 13 '20 at 11:25
  • The workaround, as I mentioned in my answer, is to install the certificates manually on each destination server and the specify the names of the certificates and their thumbprints in the installation parameters. The installation script skips the creation of self-signed certificates if certificates are provided.
    – Alessandro Faniuolo
    Feb 13 '20 at 11:30
  • I have two servers, same OS on both of them. I'm running installation on cm server directly. OK, I tried importing certificates manually but if fails. I will try to specify thumbprint and password for each on of them in install script and let you know.
    – Radovan Jelicin
    Feb 13 '20 at 11:45
0

It turns out that installing sitecore from third server (server which will not be in use - I used it only to install Sitecore on CM and CD) solved my issue. Thanks everybody for help, sorry for my late reply.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.