Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

A while ago I tried installing a certificate into IIS7 on an new Windows 2008 server at work. The import went well but when I tried to bind a site to use the new certificate I got a dialog box with the following message:

There was an error while performing this operation.

A specified logon session does not exist. 
It may already have been terminated.
(Exception from HRESULT: 0x80070520)

I managed to find a workaround (and blogged about it). Explicitly checking the "Allow this certificate to be exported" checkbox made the problem go away. I'm a bit anxious though since I think I'd rather not have the private key be exportable.

Besides my blog entry there's a couple of references to this problem but none specify a clear solution as to why this problem occurs.

Does anyone know why this is?

share|improve this question
add comment

1 Answer

Which keystore did you install the certificate into? If you right-clicked on the PFX file and selected 'install' then the answer is your user account's personal store.

Certificates for IIS should be installed in the local computer keystore. The best way to do this is by using the Certificates MMC snap-in.

MMC > Add/Remove Snap-In > Certificates > Computer account

I've never received the error you posted, but there's a good chance IIS 7 is smart enough to export the certificate from your User account to the Computer account where it belongs.

Does EventViewer provide any additional information about which logon it's trying to access?

share|improve this answer
    
I used the import certificate wizard that comes with IIS7 (from the gui) –  Markus Olsson May 6 '09 at 12:24
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.