3

During the installation of Sitecore 9.3 on a dev workstation, the following error occurs:

[ IdentityServerCertificates_CreateR... : NewRootCertificate
------------------] Could not find Cert: DO_NOT_TRUST_SitecoreRootCert in Cert:\LocalMachine\Root CertEnroll::CX509PrivateKey::Create: Access is denied. 0x80070005 (WIN32: 5 ERROR_ACCESS_DENIED)

enter image description here

Sitecore Install Assistant is running as an administrator, passes all pre-req checks, and so on.

I usually have no issues creating certificates, trusting them etc.

Any ideas?

Improve this question
2
  • can you confirm that with your user you have full administrator rights? I faced a different error because of the use was in the administrator group but was not administrator.
    – Mahendra Shekhawat
    Commented Apr 25, 2020 at 9:47
  • @MahendraShekhawat I think that is the problem. I'm an administrator but not the administrator
    – tidmutt
    Commented Apr 27, 2020 at 13:35

4 Answers 4

Reset to default
1

The user must have administrative privileges to save security files on the machine. If the user does not have write file permissions, the machine will not be able to generate the private key.

To resolve the error, log in to the machine using a login with administrative rights and try installing it again.

Improve this answer
3
  • Thank you. My login is a local administrator, but that right is not sufficient I believe. I need to understand the exact permission needed. I can generate self signed certificates in IIS manager no problems. I cannot login to the machine as the Administrator account. I work in a large corporate environment and that is not a viable option. I may be able to request the specific permission, even that is going to be difficult. I have verified that SIA is running as elevated.
    – tidmutt
    Commented Apr 27, 2020 at 13:48
  • As I pointed out in my comment, you need to have a privileged to save security files on the machine.
    – Pinoy2015
    Commented Apr 28, 2020 at 0:43
  • I'm not sure what save security files is? Anyway, I was able to get past that issue when running SIF. I see the certificates in the trusted root. Some odd difference in privileges when running an elevated SIF powershell console vs running from an elevated SIA window. Thank you.
    – tidmutt
    Commented Apr 28, 2020 at 13:57
1

Please validate you have access rights to create the certificate in Microsoft Management Console [MMC].

Seems like access issue while SIA trying to create/install the self signing certificate for your new Sitecore Website.

Improve this answer
1
  • Thank you. I can create self signed certs through IIS management console, in the cert manager MMC I can import certs, request certs.
    – tidmutt
    Commented Apr 27, 2020 at 14:06
0

Moving the comment in the answer so that it can help other people. From the error, it is clear the problem is related to permission as showing ERROR_ACCESS_DENIED. Now it's a dev workstation where the administrator adds the new user in the administrator group which is equivalent to the administrator but not the administrator. I had a similar issue in where I was installing the Sitecore 9.3 but since I was not a proper admin so from the prerequisites web deploy not installed because of permission. You need to reach to the your system admin to give proper permission to your account and you will able to install the Sitecore 9.3.

Improve this answer
3
  • Yes, I assumed it was a permissions issue. Thank you, however, I will need to be more specific than that. I will need to determine exactly what permission is needed. Most large corporate IT departments are not going to just give an entire department of developers broad rights. Honestly, we are finding SIA is a bit too fragile. We'll wait for it to evolve over a few more releases. We'll stick to using SIF directly, that gives us more control. The permission issue will remain of course, but we can work around it more easily using SIF directly.
    – tidmutt
    Commented Apr 27, 2020 at 21:44
  • Just try the PowerShell command New-SelfSignedCertificate which also creates a new certificate in the LocalMachine hive. If you can get that to work, likely the SIA will work as well - the permissions needed for the above command are likely much better documented than the APIs used by SIA.
    – Richard Hauer
    Commented May 5, 2020 at 10:16
  • @RichardHauer - Thanks, yeah SIF has worked. We'll stick with that for now.
    – tidmutt
    Commented May 6, 2020 at 20:20
0

I was facing the same issue, and this issue was because of full administrator access on the machine - where installation is going on. Hope you have resolved this issue already.

I am here sharing a solution for this that instead of the SIA way If you will try to setup instance without using SIA. It will work.

Basically with Sitecore setup with PowerShell installation, able to fetch certificate.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.