Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I feel like I must be doing something quite stupid but I can't figure out what.

I have a UCC cert for,,

I have two CAS servers and they aren't using Microsoft NLB.

I generated the CSR on and all went well with importing as well. When I try to import it to I get the following error.

[PS] C:\Windows\System32>Enable-ExchangeCertificate -Thumbprint XYZ -Services "SMTP, IIS" Enable-ExchangeCertificate : The certificate with thumbprint XYZ was found but is not valid for use with Exchange Server (reason: PrivateKeyMissing). At line:1 char:27 + Enable-ExchangeCertificate <<<< -Thumbprint XYZ -Services "SMTP, IIS"

I have tried certutil -repairstore my "certserial#" and re-importing cert

If it matters this is a GoDaddy UCC cert. Should I also be adding to the cert as well for Outlook Anywhere?


share|improve this question
up vote 0 down vote accepted

Your problem is that the second server, the one you didn't generate the csr on, does not have the private key for the cert and so can't use it. The easiest option is to export the cert from the first server as a pfx file, with the private key then import on the second.

share|improve this answer
Do these directions seem to outline just what I need to do? – PHLiGHT Sep 1 '10 at 3:40
Yes, that should do what you need. – Sam Sep 1 '10 at 6:13
Thanks, that did the trick. I wish digicert's prices were closer to GoDaddy's because they have excellent support docs. GoDaddy said I was pretty much on my own and would need to contact Microsoft for help. – PHLiGHT Sep 1 '10 at 12:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.