Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an ASP.NET webservice that communicates with another webservice using a client-side certificate. The certificate is located in the LOCAL_MACHINE store. I have granted "Network Services" access to the certificate via winhttpcertcfg.exe. I know that I'm granting permission properly, because I got everything working on a development box and the permission was the step that made it work.

So I'm trying to figure out what is different between my development box and my production box. They both have IIS 6.0. They both have my webservice installed. They both have the same certificate in the local machine store with "Network Services" permission. They're both able to see the other webservice via IE when the certificate is selected. They're both able to consume the other webservice via non-IIS applications using the cert in CURRENT_USER. I've visually gone through every IIS setting that I know of, and they seem to be the same.

So, is there some setting that could be causing "Network Services" to look somewhere besides the LOCAL_MACHINE store for certificates? Or is there something else I could be overlooking?

share|improve this question

Have you tried this procedure to installing a certificate for the Network Services account? It involves temporarily adding the Network Services account to the Administrator's group.

You can also look at this person's solution to getting a cert to work in IIS 6.0

share|improve this answer
up vote 0 down vote accepted

I tried the procedure listed by Jack B Nimble for adding the certificate to the Network Services account, but that did not seem to help.

I finally solved my problem by 1. in IIS, going to the Directory Security tab under my Website 2. clicking "Server Certificate" 3. importing my certificate through the wizard

I thought this step was superfluous because it dealt with server-side certificates. Even though the certificate was already in the LOCAL_MACHINE, something about the process above causes "Network Services" to see it. This is true even after "Removing" the certificate with the wizard.

This is a step that had been done on my development box (experimentally) but not on my production box.

"Network Services" is definitely using the LOCAL_MACHINE certificate now, because toggling permissions also toggles my webservice's ability to communicate.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.