Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

I have an SSL certificate installed on a Windows Server 2003 box that is due to expire next week.

I was going to take the renewal opportunity to move the website to a different server however someone else has gone ahead and part installed a renewed certificate on the same server.

Is it possible for me to move the certificate from the 2003 box to a 2008 box?

I understand this should be as simple as exporting the old certificate and importing the new one but I can't get it to work.

  • Through the MMC console on the 2003 box i exported the newly installed certificate as a p7b, including all certificates where possible.

  • Copied the file to the 2008 box

  • imported the cert into the personal certificates store through MMC

It said import successful and I can see the cert in the list however it doesnt show up in IIS :(

What am I doing wrong?

Thanks

share|improve this question
Hm, this certificate maybe tight up to the higher certification authority which certificate you didn't copy. Check the certificates chain on the original server. – Vick Vega Mar 30 '11 at 15:06
The fact that he doesn't see the certificate means that it is not in the proper key store. It is not a trust problem. – Mircea Vutcovici Mar 30 '11 at 15:08

2 Answers

up vote 2 down vote accepted

Most likely you have only copied over the certificate chain, but not the private key for the SSL certificate. It should mention if it has a private key in the certificate information. When a certificate with a private key is first imported into Windows, there is an option to allow the private key to be marked exportable, if it is not (which is default), then Windows will not allow you to export the private key and move it elsewhere. There might be some tools for getting around this, but it's certainly not Microsoft approved. Look at the certificate information on the original computer and it should report that a private key is available, but I bet it's not exportable.

share|improve this answer
Where will i find if it has a private key? I dont know how the renewal certificate was generated, but i suspect it was the "renew" option. does this mean i can obtain the private key from the original, due-to-expire cert and import that too? do i need to combine it with the new cert somehow or can it be imported separately? – Andrew Bullock Mar 30 '11 at 15:16
No, the original private key will be different. If the private key for the new cert isn't exportable/available, you will need to rekey the certificate with your provider. I would just generate a CSR on the 2008 box and submit it to your provider to get a matching certificate. – Robert Mar 30 '11 at 15:34
Just rang them and they will revoke it and reissue for free :D yay – Andrew Bullock Mar 30 '11 at 16:03
It should say at the bottom of the certificate information. Take a look at this for an example: jacco2.dds.nl/networking/screenshots/cert/certinfo.png – penguin359 Mar 30 '11 at 16:11
up vote 1 down vote

The problem is that the certificate is not installed in the proper key store. I mean it should be in Computer account. Make sure you are installing the private key to. Normally it should be in the same file. At the export time you have been asked for a password to encrypt the private key. The same password you have to use to import the key.

share|improve this answer
When i try to export the due-to-expire cert i get the option to export they private key. When i try and export the new cert i dont get that option. – Andrew Bullock Mar 30 '11 at 15:18
This means that you do not have the private key. Without that key, the certificate is useless. – Mircea Vutcovici Mar 30 '11 at 15:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.