We have a CM instance of Sitecore 10.1.1. On CM instance we have an XConnect setup as well. Our analytics page throws an error. When I checked the logs, I found the below error.

    Severity level: Error, 

    Exception System.InvalidOperationException: Ensure definition type did not complete successfully. **StatusCode: 401, ReasonPhrase: 'Invalid certificate'**, Version: 1.1, Content: System.Net.Http.StreamContent, Headers:

      Pragma: no-cache
      Cache-Control: no-cache
      Date: Tue, 25 Jul 2023 18:55:52 GMT
      Server: Microsoft-IIS/10.0
      X-AspNet-Version: 4.0.30319
      X-Powered-By: ASP.NET
      Content-Length: 0
      Expires: -1

The same error shows up when we try to delete any item from Sitecore.

Steps done so far:

  1. We have verified the certificate thumbprint in all config files. It is the same as the one used in IIS for the website
  2. The relevant app pool user has access to the certificate. Also, IIS_IUSRS has access to cert
  3. Ensured that trusted root does not contain non-self-signed certificates
  4. Ensured that xConnect instances accept Client Certificates

What else we could be missing?

  • Your step 1 says that config thumbprint matches in IIS. It should match with client cert's thumbprint and not with server certificates' thumbprints. Commented Jul 25, 2023 at 19:28
  • Yes, I mean thumbprint matches the client cert's thumprint and correct is configured in IIS Commented Jul 25, 2023 at 19:41

1 Answer 1


To resolve the certificate issue, Try the below solutions.

Solution 1

  1. Ensure that the certificate thumbprint in the connection strings of Sitecore XP roles matches the thumbprint of the certificate in use:
<add name="xconnect.collection.certificate" 
connectionString="StoreName=My;StoreLocation=CurrentUser;FindType=FindByThumbprint;FindValue=83DCC21BBF54D76F71D7B67EA2319273BCDA8E19" />
<add name="sitecore.reporting.client.certificate" 
connectionString="StoreName=My;StoreLocation=CurrentUser;FindType=FindByThumbprint;FindValue=83DCC21BBF54D76F71D7B67EA2319273BCDA8E19" />
<add name="xdb.marketingautomation.operations.client.certificate" 
connectionString="StoreName=My;StoreLocation=CurrentUser;FindType=FindByThumbprint;FindValue=83DCC21BBF54D76F71D7B67EA2319273BCDA8E19" />
<add name="xdb.marketingautomation.reporting.client.certificate" 
connectionString="StoreName=My;StoreLocation=CurrentUser;FindType=FindByThumbprint;FindValue=83DCC21BBF54D76F71D7B67EA2319273BCDA8E19" />
<add name="xdb.referencedata.client.certificate" 
connectionString="StoreName=My;StoreLocation=CurrentUser;FindType=FindByThumbprint;FindValue=83DCC21BBF54D76F71D7B67EA2319273BCDA8E19" />
  1. Ensure that the validateCertificateThumbprint value of xConnect and Marketing Automation roles matches the thumbprint of the certificate in use. The setting can be found in the following file: \App_Config\AppSettings.config
  2. Ensure that the xconnect.collection.certificate connection string of the AutomationEngine job has correct certificate thumbprint: \App_Data\jobs\continuous\AutomationEngine\App_Config\ConnectionStrings.config
  3. [For Sitecore XP 9.1+] Ensure that xconnect.collection.certificate, xconnect.configuration.certificate, and xconnect.search.certificate connection strings of the ProcessingEngine job have the correct thumbprints: \App_Data\jobs\continuous\ProcessingEngine\App_Config\ConnectionStrings.config
  4. Ensure that the AllowInvalidClientCertificates app setting is true on Sitecore XP roles if your certificate is self signed (the setting can be found in the Web.config file by default): <add key="AllowInvalidClientCertificates" value="True" />
  5. Ensure that the AllowInvalidClientCertificates app setting is true on xConnect roles if your certificate is selfsigned. The setting can be found in the following files by default: \App_Config\AppSettings.config \App_Data\jobs\continuous\JOB_NAME_GOES_HERE\App_Config\AppSettings.config

Note: Thumbprint value needs to be uppercase in configuration.

Reference:Troubleshooting xConnect certificate issues

Solution 2

Move/Remove all self-signed certificates from the root store.

  1. Firstly, this PowerShell command will show you all non-self-signed certificates in your root store:
Get-Childitem cert:\LocalMachine\root -Recurse | Where-Object {$_.Issuer -ne $_.Subject}
  1. Moves the offending certificates above into the Intermediate Certification Authorities (i.e. CA) store:
Get-Childitem cert:\LocalMachine\root -Recurse | Where-Object {$_.Issuer -ne $_.Subject} | Move-Item -Destination Cert:\LocalMachine\CA




Hope it helps!

  • Tried everything. Still same error :( Commented Jul 26, 2023 at 18:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.