Sitecore 9.2 installation Certificate issue fail (importing PFX file)

Question

While I'm installing Sitecore 9.2.0 rev. 002893. I've reached step 29 where an error occurs:

[------------------------------------------------------------------------------------------ ImportRootCert : ImportPfxCertificate ------------------------------------------------------------------------------------]
Install-SitecoreConfiguration : The PFX file you are trying to import requires either a different password or membership in an Active Directory principal to which it is protected.
At ******************\Install-XP1-Distributed.ps1:209 char:1
+ Install-SitecoreConfiguration @DistributedDeploymentParams -Verbose * ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Install-SitecoreConfiguration

[TIME] 00:05:32

In C:\certificates there are 3 pfk files created:

• SitecoreRootCert.pfx

• SERVER_DNS.pfx

• DEFINED_PREFIX.xconnect.pfx

Each *.pfk file can be imported manually with passwords that are visible in a log file for each certificate.

I'm using windows admin user. I'm running Install-XP1-Distributed.ps1 script from the official installer. I populated the required variables.

Is there any configuration option I need to set/remove to resolve this?

If more info is needed I will provide it, just let me know.

Thanks in advance.

Answer 1

There are different versions of the Import-PfxCertificate and the Export-PfxCertificate cmdlets. The versions that come with Windows Server 2016 and Windows 10 1703 and earlier do not support importing a PFX generated using the AES256_SHA256 cryptographic algorithm and result in the error that you experienced.

This issue doesn't occur with the version of these cmdlets that come in Windows Server 2016 1709 and Windows 10 1709 and newer, when using the AES256_SHA256 cryptographic algorithm.

You can probably avoid this issue, installing the required certificates on each server manually and then specify the correct certificates to use in the installation input parameters. This is the same process to follow when using signed certificates for a production setup, as described in the official Sitecore installation guide.