Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am attempting to use an SSL certificate to secure LDAPS on our Active Directory, following the instructions found on Microsoft website at

I am logged on as Domain Admin on the machine where the certificate is to be storted. I create the request and submit to our CA. They then return the certificate. I then import the certifcate into the Active Directory Domain Services NTDS\Personal Store. The certificate imports and is visible. However it is not possible to connect to LDAPs over SSL. Investigations show that the private key has not been associated with the certificate at import.

The Domain Controller has been restarted and this caused the following error to appear in the System Log. Event 36869 Schannel The SSL server credential's certificate does not have a private key information property attached to it. This most often occurs when a certificate is backed up incorrectly and then later restored. This message can also indicate a certificate enrollment failure.

Clearly since this is a new key there is no backup problem.

Does anyone have any idea what I can do to get the Private Key to assoiciate with the certificate. I have been right through the process twice, revoking the original certificate. I am always logged on a domain admin.

Many thanks.

share|improve this question
I believe I have seen something similar before. Can you find the cert in the cert manager and see if there is a repair option? – Jeremy Oct 7 '11 at 14:53
How did you create the certificate request? – Coding Gorilla Oct 7 '11 at 14:54
There is no obvious repair option in the Certificates Snap In. Certificate was created using certreq -new request.inf request.req – RichardP Oct 7 '11 at 15:04

The certificate that's returned must be used to complete the certificate request, not just imported into the store.

See step 5 in that KB:

certreq -accept certnew.cer

This should automatically place the certificate in the store, it does not need a manual import.

Additionally, it should be in the computer's personal store, not the service's store.

share|improve this answer
Should have mentioned this is Server 2008 so the suggested location for the certificate is in the NTDS store, this is in an amendment at the bottom of the article. The Personal store is still valid, that said I have tried both locations with the same result. – RichardP Oct 7 '11 at 15:06
@RichardP Still, you need to be -accepting the certificate to complete the request instead of just importing the certificate that you get back into a store. – Shane Madden Oct 7 '11 at 15:08
Yes I did follow all the steps including that one. I subsquently imported the certificate into the NTDS Store. – RichardP Oct 7 '11 at 15:14
@RichardP So, to be clear, you've got a copy of the certificate in the personal computer store with the private key, and one in the personal NTDS service store without the private key? Remove the one without a private key. – Shane Madden Oct 7 '11 at 15:16
@RichardP But there were no errors when you ran certutil -accept? Huh - the private key ought to be somewhere. Check you user's store, maybe. Otherwise, I'd say clear all copies of the cert out, issue a new request, and try again - if the private key isn't on the certificate that's automatically put in the store when certutil -accept is run, there's a problem. – Shane Madden Oct 7 '11 at 15:29

The certutil will place this in the machine store. You may open up both stores within a MMC and copy the cert issued to the machine store, to the ADDS serivce store so that it then has the private key with it.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.