Sitecore XConnect Certificate error

Question

We have a CM instance of Sitecore 10.1.1. On CM instance we have an XConnect setup as well. Our analytics page throws an error. When I checked the logs, I found the below error.

    Severity level: Error, 

    Exception System.InvalidOperationException: Ensure definition type did not complete successfully. **StatusCode: 401, ReasonPhrase: 'Invalid certificate'**, Version: 1.1, Content: System.Net.Http.StreamContent, Headers:

    {
      Pragma: no-cache
      Cache-Control: no-cache
      Date: Tue, 25 Jul 2023 18:55:52 GMT
      Server: Microsoft-IIS/10.0
      X-AspNet-Version: 4.0.30319
      X-Powered-By: ASP.NET
      Content-Length: 0
      Expires: -1
    }

The same error shows up when we try to delete any item from Sitecore.

Steps done so far:

1. We have verified the certificate thumbprint in all config files. It is the same as the one used in IIS for the website
2. The relevant app pool user has access to the certificate. Also, IIS_IUSRS has access to cert
3. Ensured that trusted root does not contain non-self-signed certificates
4. Ensured that xConnect instances accept Client Certificates

What else we could be missing?

Answer 1

To resolve the certificate issue, Try the below solutions.

Solution 1

1. Ensure that the certificate thumbprint in the connection strings of Sitecore XP roles matches the thumbprint of the certificate in use:

<add name="xconnect.collection.certificate" 
connectionString="StoreName=My;StoreLocation=CurrentUser;FindType=FindByThumbprint;FindValue=83DCC21BBF54D76F71D7B67EA2319273BCDA8E19" />

<add name="sitecore.reporting.client.certificate" 
connectionString="StoreName=My;StoreLocation=CurrentUser;FindType=FindByThumbprint;FindValue=83DCC21BBF54D76F71D7B67EA2319273BCDA8E19" />

<add name="xdb.marketingautomation.operations.client.certificate" 
connectionString="StoreName=My;StoreLocation=CurrentUser;FindType=FindByThumbprint;FindValue=83DCC21BBF54D76F71D7B67EA2319273BCDA8E19" />

<add name="xdb.marketingautomation.reporting.client.certificate" 
connectionString="StoreName=My;StoreLocation=CurrentUser;FindType=FindByThumbprint;FindValue=83DCC21BBF54D76F71D7B67EA2319273BCDA8E19" />

<add name="xdb.referencedata.client.certificate" 
connectionString="StoreName=My;StoreLocation=CurrentUser;FindType=FindByThumbprint;FindValue=83DCC21BBF54D76F71D7B67EA2319273BCDA8E19" />

2. Ensure that the validateCertificateThumbprint value of xConnect and Marketing Automation roles matches the thumbprint of the certificate in use. The setting can be found in the following file: \App_Config\AppSettings.config
3. Ensure that the xconnect.collection.certificate connection string of the AutomationEngine job has correct certificate thumbprint: \App_Data\jobs\continuous\AutomationEngine\App_Config\ConnectionStrings.config
4. [For Sitecore XP 9.1+] Ensure that xconnect.collection.certificate, xconnect.configuration.certificate, and xconnect.search.certificate connection strings of the ProcessingEngine job have the correct thumbprints: \App_Data\jobs\continuous\ProcessingEngine\App_Config\ConnectionStrings.config
5. Ensure that the AllowInvalidClientCertificates app setting is true on Sitecore XP roles if your certificate is self signed (the setting can be found in the Web.config file by default): <add key="AllowInvalidClientCertificates" value="True" />
6. Ensure that the AllowInvalidClientCertificates app setting is true on xConnect roles if your certificate is selfsigned. The setting can be found in the following files by default: \App_Config\AppSettings.config \App_Data\jobs\continuous\JOB_NAME_GOES_HERE\App_Config\AppSettings.config

Note: Thumbprint value needs to be uppercase in configuration.

Reference:Troubleshooting xConnect certificate issues

Solution 2

Move/Remove all self-signed certificates from the root store.

1. Firstly, this PowerShell command will show you all non-self-signed certificates in your root store:

Get-Childitem cert:\LocalMachine\root -Recurse | Where-Object {$_.Issuer -ne $_.Subject}

2. Moves the offending certificates above into the Intermediate Certification Authorities (i.e. CA) store:

Get-Childitem cert:\LocalMachine\root -Recurse | Where-Object {$_.Issuer -ne $_.Subject} | Move-Item -Destination Cert:\LocalMachine\CA

References:

https://www.getfishtank.com/blog/sitecore-9-xconnect-status-403-forbidden-certificate-error

https://darjimaulik.wordpress.com/2020/07/20/sitecore-xconnect-certificate-error-http-response-was-not-successful-forbidden/

Hope it helps!