What name format/should be used for the xConnectCert prompt of Install-SitecoreConfiguration?

The Self-Signed Cert is located in the (Local Computer)\Trusted Root Certification Authorities\Certificates folder per Installation Guide.

But so far, no matter what format/name that I have used I get the following error:

[--------------------------------- SetCertStorePermissions : FilePermissions -----------------------------------]
WARNING: Could not find Cert: sc9-cert in Cert:\Localmachine\My
Install-SitecoreConfiguration : Unable to parse
[ResolveCertificatePath(variable('Security.XConnect.CertificatePath'))] - Exception calling "InvokeWithContext"
"2" argument(s): "The running command stopped because the preference variable "ErrorActionPreference" or common
parameter is set to Stop: Cert:\Localmachine\My is not a valid Certificate Path"
At line:1 char:1
+ Install-SitecoreConfiguration -Path "D:\downloads\sitecore\sif\Siteco ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Install-SitecoreConfiguration
  • I used this powershell command to create the cert: New-SelfSignedCertificate -DnsName *.mydomain.com -CertStoreLocation cert:\LocalMachine\My – Radical Dave Oct 22 '17 at 23:01
up vote 7 down vote accepted

Installation Guide has the answers, but you have to skip ahead to Section 5.1 and 5.2. Section 5.2 has an example script to use

You can download the guide here: https://dev.sitecore.net/Downloads/Sitecore_Experience_Platform/90/Sitecore_Experience_Platform_90_Initial_Release.aspx

Section 5.1 has details and Section 5.2 has PowerShell script that has this section for xConnect:

deploy xConnect instance

 $xConnectParams = @{

   Path = "$PSScriptRoot\xconnect-xp0.json"    
   Package = "$PSScriptRoot\Sitecore 9.0.0 rev. 171002 (OnPrem)_xp0xconnect.scwdp.zip"
   LicenseFile = "$PSScriptRoot\license.xml"
   Sitename = $XConnectCollectionService
   XConnectCert = $certParams.CertificateName
   SqlDbPrefix = $prefix
   SqlServer = $SqlServer
   SqlAdminUser = $SqlAdminUser
   SqlAdminPassword = $SqlAdminPassword
   SolrCorePrefix = $prefix
   SolrURL = $SolrUrl
 }
 Install-SitecoreConfiguration @xConnectParams 

One other thing that caught me during this, the Solr Documentation (found here: https://lucene.apache.org/solr/guide/6_6/enabling-ssl.html ) states: Client Authentication Settings Enable either SOLR_SSL_NEED_CLIENT_AUTH or SOLR_SSL_WANT_CLIENT_AUTH but not both at the same time. They are mutually exclusive and Jetty will select one of them which may not be what you expect.

So, I had tried setting SOLR_SSL_NEED_CLIENT_AUTH=true; .. no go. Keep them both false and everything worked for me. http - no, https - success.

  • Can you please give a little insight into what you found in the docs. Many people are going to have certificate questions as it relates to SIF. – Chris Auer Oct 23 '17 at 3:32
  • Thanks Dave, I meant to update your answer above. Just so the next person with the problem will have something to go off of. – Chris Auer Oct 23 '17 at 3:46
  • 1
    Great idea. Done. Thanks Chris – Radical Dave Oct 23 '17 at 3:50

The short answer to solve this issue, assuming you are trying to setup a local development environment or sandbox, is that you need to have your self signed certificate which you can create from IIS and put in the place where the SIF will try to find it.

The location where the SIF is trying to look is:

"LocalMachine > Personal (My)"

The self signed certificate from IIS is not located there.

If you don't want touch the .json files then copy and paste the certificate which is located in:

"LocalMachine > WebHosting"

Copy/paste the certificate to

"LocalMachine > Personal > Certificates"

After pasting the certificate to the location obtain the thumbprint from the certificate and get rid of the white-spacing so you keep a number of 43 hexadecimal characters. That is the number you can use for the installation.

  • Thanks for the extra info Alex. I was able to get it to work with the help of the Slack channel and in the case you have to read the whole Installation Guide (jump ahead) it isn't necessarily a "step by step" guide. – Radical Dave Nov 3 '17 at 3:44

Ran into similar issue today. Based on your exception, looks like the certificate you created is not what Sitecore is expecting.

Sitecore is expecting a X509Certificate2 certificate

 if ($CertificatePath -notlike 'cert:\*') {
        throw "Certificate Path must start with 'cert:\' - $CertificatePath"
 }

 $certificate = Get-Item -Path $CertificatePath

 if ($certificate.GetType().Name -ne "X509Certificate2") {
     throw "$CertificatePath is not a valid Certificate Path"
 }

Note that I am using Windows 8.1 with IIS 8.5. Here is the code I have used to create the required certificate. Assuming all the default variables as defined in Sitecore guide are followed

$Path = "c:\\certificates"
$Name = "xp0.xconnect_client"
$Signer = Invoke-GetCertificateConfigFunction -Id 'DO_NOT_TRUST_SitecoreRootCert' -CertStorePath Cert:\LocalMachine\Root -Verbose
$Signer.GetType()
$DnsName = "xp0.xconnect_client"
$CertStoreLocation = 'Cert:\LocalMachine\My'
$signedCertificate = New-SelfSignedCertificate  -CloneCert $Signer -DnsName $DnsName -CertStoreLocation $CertStoreLocation -Verbose
                if ($null -eq $signedCertificate) {

                    throw "Failed to create signed certificate for '$DnsName' in $CertStoreLocation"
                }
                Write-Host "Created signed certificate $signedCertificate"


            Write-Host "Export new certificate public key as a CRT file"
            $exportFilePath = Join-Path -Path $Path -ChildPath "$Name.crt"
            $certificateInfo = Export-Certificate -Cert $signedCertificate -FilePath $exportFilePath -Force

            Write-Information -MessageData "Exported signed certificate to $exportFilePath"

Trick is here. You can use the Root certificate for cloning and use a different Dns name (in my case xp0.xconnect_client)

New-SelfSignedCertificate  -CloneCert $Signer -DnsName $DnsName -CertStoreLocation $CertStoreLocation -Verbose

Done these, I am still trying to get SIF work on my Windows 8.1 with IIS 8.5

  • Thanks Phani. I was able to get it to work after pinging Slack channel. The answers are all in the Installation Guide, but you have to jump ahead to Section 5.1 and 5.2. Thanks. – Radical Dave Nov 3 '17 at 3:43

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.