Issues with XConnect certificate does not contain Private Key

Question

I have a Windows Server 2016, SIF and Sitecore Fundamentals installed where I am trying to provision a Sitecore 9 XP1

Here is the error I am seeing

CERT:\LocalMachine\My\210E7393A00B188EEB841E22CB09BA5660D6C3E9 does not contain Private Key

I generated self-signed certificates for XConnect and XConnect Collection using a Powershell command

New-SelfSignedCertificate -DNSName xconnect.local -CertStoreLocation cert:\LocalMachine\My
New-SelfSignedCertificate -DNSName xconnectcollection.local -CertStoreLocation cert:\LocalMachine\My

Then I have exported the certificate as PFX

$sslPassword = ConvertTo-SecureString "P@ssw0rd" -Force -AsPlainText
Export-PfxCertificate -Cert cert:\LocalMachine\My\210E7393A00B188EEB841E22CB09BA5660D6C3E9  -FilePath C:\temp\xconnectlocal.pfx -Password $sslPassword
Export-PfxCertificate -Cert cert:\LocalMachine\My\0486F9D98837A08726A238E1431F010B5256E99A  -FilePath C:\temp\xconnectcollectionlocal.pfx -Password $sslPassword

And manually imported on Trusted Root Certification

On xconnect-xp1-collection.json, I have modified the SSLCert to match XConnectCollection Thumbprint

"SSLCert": {
            "Type": "string",
            "Description": "The certificate to use for HTTPS web bindings. Provide the name or the thumbprint. If not provided a certificate will be generated.",
            "DefaultValue": "0486F9D98837A08726A238E1431F010B5256E99A"

When prompted during the SIF process, XConnectCert I then add the Thumbprint from XConnect.local SSL

Finally, I receive the 210E7393A00B188EEB841E22CB09BA5660D6C3E9 does not contain Private Key error

I have seen other similar questions

1. Sitecore 9 XP0 XConnect Cert Requirements
2. Issue with Sitecore 9 certificate missing private key

However, none of these solved my issue.

Any ideas what might causing the issue?

Answer 1

Differently from XP1, the XP0 topology has a JSON file specifically for create the certificate - xconnect-createcert.json

After creating the certificate using xconnect-createcert.json, I have tried provisioning the XConnect-Collection as I was doing and the error went away.

Now, I wonder what am I missing while generating my certificates manually... well at least it worked and XP0 package has the xconnect-createcert.json which solved the issue!

Answer 2

Try altering the certificate creation step to explicitly allow export of the private key.

So instead of:

New-SelfSignedCertificate -DNSName xconnect.local -CertStoreLocation cert:\LocalMachine\My

Try this:

New-SelfSignedCertificate -DNSName xconnect.local -KeyExportPolicy Exportable -CertStoreLocation cert:\LocalMachine\My

Normally when importing a key into the cert store through the Certificate Management UI you need to explicitly check the "make private key exportable" box, so I assume the default policy is to disallow export of the private key.