16

I have a Windows Server 2016, SIF and Sitecore Fundamentals installed where I am trying to provision a Sitecore 9 XP1

Here is the error I am seeing

CERT:\LocalMachine\My\210E7393A00B188EEB841E22CB09BA5660D6C3E9 does not contain Private Key

I generated self-signed certificates for XConnect and XConnect Collection using a Powershell command

New-SelfSignedCertificate -DNSName xconnect.local -CertStoreLocation cert:\LocalMachine\My
New-SelfSignedCertificate -DNSName xconnectcollection.local -CertStoreLocation cert:\LocalMachine\My

Then I have exported the certificate as PFX

$sslPassword = ConvertTo-SecureString "P@ssw0rd" -Force -AsPlainText
Export-PfxCertificate -Cert cert:\LocalMachine\My\210E7393A00B188EEB841E22CB09BA5660D6C3E9  -FilePath C:\temp\xconnectlocal.pfx -Password $sslPassword
Export-PfxCertificate -Cert cert:\LocalMachine\My\0486F9D98837A08726A238E1431F010B5256E99A  -FilePath C:\temp\xconnectcollectionlocal.pfx -Password $sslPassword

And manually imported on Trusted Root Certification

On xconnect-xp1-collection.json, I have modified the SSLCert to match XConnectCollection Thumbprint

"SSLCert": {
            "Type": "string",
            "Description": "The certificate to use for HTTPS web bindings. Provide the name or the thumbprint. If not provided a certificate will be generated.",
            "DefaultValue": "0486F9D98837A08726A238E1431F010B5256E99A"

When prompted during the SIF process, XConnectCert I then add the Thumbprint from XConnect.local SSL

enter image description here

Finally, I receive the 210E7393A00B188EEB841E22CB09BA5660D6C3E9 does not contain Private Key error enter image description here

I have seen other similar questions

  1. Sitecore 9 XP0 XConnect Cert Requirements
  2. Issue with Sitecore 9 certificate missing private key

However, none of these solved my issue.

Any ideas what might causing the issue?

8

Differently from XP1, the XP0 topology has a JSON file specifically for create the certificate - xconnect-createcert.json

enter image description here

After creating the certificate using xconnect-createcert.json, I have tried provisioning the XConnect-Collection as I was doing and the error went away.

enter image description here

Now, I wonder what am I missing while generating my certificates manually... well at least it worked and XP0 package has the xconnect-createcert.json which solved the issue!

2

Try altering the certificate creation step to explicitly allow export of the private key.

So instead of:

New-SelfSignedCertificate -DNSName xconnect.local -CertStoreLocation cert:\LocalMachine\My

Try this:

New-SelfSignedCertificate -DNSName xconnect.local -KeyExportPolicy Exportable -CertStoreLocation cert:\LocalMachine\My

Normally when importing a key into the cert store through the Certificate Management UI you need to explicitly check the "make private key exportable" box, so I assume the default policy is to disallow export of the private key.

  • I changed the method to create the certificate and still receiving the same error... Any other idea? – Vinicius Deschamps Dec 1 '17 at 18:56
  • When I used that method in testing, I was able to validate that the private key was present. Perhaps the error is misleading? Try putting a copy in the Trusted Root Certificate Authority store as well to ensure the very presents as valid in the snap in. – Richard Hauer Dec 1 '17 at 21:59
  • *verify (not very) – Richard Hauer Dec 3 '17 at 6:18
  • I have XConnect SSL in Trusted Root Certification, and the certificate says "You have a private key that corresponds to this certificate". Now, I wonder if is there any sequence to install the XP1 and I am deploying it wrong. – Vinicius Deschamps Dec 4 '17 at 11:15
  • 1
    @ViniciusDeschamps I haven't got any information to contribute there at the moment I'm afraid. I would raise that as a new question. – Richard Hauer Dec 5 '17 at 0:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.