Sorry, this seems more simple than I am making it to be but I am just running into multiple errors after reading and trying multiple articles. So after my initial installation of Sitecore, my certs have expired, I have tried creating just one self-assigned cert and then assigning it to my site app pool, which will allow my site to run even though I still get the site isn't secure and passes it on to the unsafe site, however when I try to get to my local Sitecore tree I can NOT get my login page to load up with these certs. I just get the below error.

HTTP Error 403.16 - Forbidden
Your client certificate is either not trusted or is invalid.

I don't know if I need to update the identity server, xconnect, and reg app pool with the new cert and then update all the thumbprints or what I need to really do. None of the articles really hit my points, trying to look for help to have the exact walk-through I need. So unsure about thumbprints and if I need to delete the other expired certs, etc.

1 Answer 1


Please follow steps below and i hope this resolve your issue :

Step 1 – Create a Self-signed certificate

  1. Run Windows Powershell as Administrator

  2. Type the follow command, then hit enter

    New-SelfSignedCertificate -DnsName mydomain.com -CertStoreLocation cert:\LocalMachine\My

Step 2 – Use Self-Signed Certificate on IIS

  1. Open IIS, expand sites enter image description here
  2. Select the Site you want to use Self-Signed certificate, right-click on it then Edit Bindings

enter image description here

  1. In Site Bindings, click Add

enter image description here

  1. In Add Site Binding, choose Type HTTPS and on SSL certificate choose the certificate create in Step 1, and click Ok then Close (Site Bindings window)

enter image description here

  1. Create a password using the following command $sslPassword = ConvertTo-SecureString "P@ssw0rd" -Force -AsPlainText

  2. Export the certificate as PFX file using the command below Export-PfxCertificate -Cert cert:\LocalMachine\My\AB34CF46EF6DAAE6FCB69C65F4A9C07710644F3F -FilePath C:\temp\mydomain.pfx -Password $sslPassword

  3. Navigate to the folder you saved the PFX file and check if it was created. In my case, it was on C:\temp

enter image description here

  1. Import Certificat

enter image description here

Please find the complete post with all the details below :


  • 3
    Would be great to fine-tune this answer with code from this blog post and refer blog post at the end. Sometimes blog does not exist, in that case, this answer will be still relevant Mar 17, 2022 at 7:10
  • 2
    I want to add that this post helped me with the link provided. I did however run into issues with login so I recreated these steps for my Xconnect and IdentityServer using those names instead of mydomain example and worked great. Thank you for the help. Mar 17, 2022 at 18:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.