Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In Windows 2003 it was simple to do and one could use the winhttpcertcfg.exe (download) to give "NETWORK SERVICE" account access to a certificate.

I'm now using Windows Server 2008 R2 with IIS 7.5 and I am unable to find where and how to set permissions access permissions to a certificate in the certificate store. This Post showed how to do it in Vista and that winhttpcertcfg features were added into the certificates mmc however it doesn't seem to work with imported certificates or doesn't work anymore on Server 2008 R2.

So does anyone have any idea on how give IIS 7.5 the correct permissions to read a certificate from the certificate store? And also what account from IIS 7.5 that needs the permission.

share|improve this question

migrated from stackoverflow.com Apr 9 '10 at 17:44

This question came from our site for professional and enthusiast programmers.

add comment

3 Answers 3

up vote 10 down vote accepted
  1. Create / Purchase certificate. Make sure it has a private key.
  2. Import the certificate into the "Local Computer" account. Best to use Certificates MMC. Make sure to check "Allow private key to be exported"
  3. Based upon which, IIS 7.5 Application Pool's identity use one of the following.

    • IIS 7.5 Website is running under ApplicationPoolIdentity. Using Certificates MMC, added "IIS AppPool\AppPoolName" to Full Trust on certificate in "Local Computer\Personal". Replace "AppPoolName" with the name of your application pool.
    • IIS 7.5 Website is running under NETWORK SERVICE. Using Certificates MMC, added "NETWORK SERVICE" to Full Trust on certificate in "Local Computer\Personal".
    • IIS 7.5 Website is running under "MyIISUser" local computer user account. Using Certificates MMC, added "MyIISUser" (a new local computer user account) to Full Trust on certificate in "Local Computer\Personal".

EDIT: To add a user to Full Trust of a certificate. Right click the certificate -> All Tasks -> Manage Private Keys

share|improve this answer
add comment

The answer of Thames is a good answer but it causes also a problem. I have a .P12 file that also includes the 'trusted root Certification Authories' and a 'intermdediate Certification Authories' and when you explicit put the certificates in "local computer\personal' those two additional certificates are not found (without any notification / exceptions) and the request will fail

share|improve this answer
    
what if you automatically let it import the certificates? do the go in the correct places? –  thames Jul 21 '10 at 22:00
    
@thames: I have a similar problem and if I import certificate into Trusted roots or set it to automatically select appropriate store it gets to trusted roots. I can't set trust permissions on these certificates... One can only set private key permissions on personal certificates and not in other stores. Any suggestions? Also check my question on Stackoverflow. –  Robert Koritnik May 14 '12 at 9:27
1  
@RobertKoritnik: I answered your question on Stackoverflow. Though not sure if it'll work in your situation as I haven't tried it. stackoverflow.com/questions/10580326/… –  thames May 15 '12 at 4:26
add comment

You can use this tool to get the private key (FindPrivateKey)

http://msdn.microsoft.com/en-us/library/ms732026.aspx

And once you get the private key, grant permissions to the key manually

Here a complete reference about how to do it

http://www.qualitydata.com/products/windows-cardspace/information-card-ssl-certificate-private-key.aspx (not sure if applies for windows server 2008, but it's worth a try)

share|improve this answer
    
Yeah I saw articles on that however everything referred to Server 2003 or XP so I didn't give it a try. I'll give this a try if no other answer comes up. –  thames Apr 9 '10 at 17:32
    
dead link fwiw ... –  jcolebrand Mar 27 '13 at 3:05
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.