Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to set up secured communications between two windows machines. I have generated a set of certificates for this purpose and saved them as .x509 files.

If I set about installing those on another machine, I get the The integrity of this certificate cannot be guaranteed. The certificate may be corrupted or may have been altered. warning. I understand that this means it cannot verify certificates up the chain, but I don't know what I need to do to authorise them. Previously I have been able to do this by viewing the root certificate from the imported certificate in the certificate manager, exporting it as a .cer file and then re-importing that file to the "Trusted Root Certification Authorities" store, but that doesn't seem to work here and if I am honest I am basically doing that as a voodoo process- I don't understand what its purpose is and given that I want to be able to automate the whole thing through Powershell I think I need to deepen my comprehension here. Unless someone has a convenient scriptlet that has this covered, of course. That would be excellent.

What I really want to do is to have a set of files representing my current certificate chain that can be imported as part of an installation process, with whatever administrator interaction is required, and will install a working chain that I can then use from my application to set up a secure pipe between two machines.

I am installing the actual Certificates I plan to use to LocalMachine\My

share|improve this question
What version of Windows Server is it? Is the x509 cert a self signed one? Asking because I faced a similar issue & fixed it. – user93353 Jul 10 '13 at 5:15
Just saw the title - yours is Windows 2008. My problem was on 2003 - so it's probably a different one. – user93353 Jul 10 '13 at 8:22
It could well be a similar problem- by all means add an answer- at least anyone running into this on Win2k3 will be helped... – glenatron Jul 10 '13 at 9:18
Ok, added my answer:-) – user93353 Jul 10 '13 at 9:25

Trusted Root Certificates are self signed certificates. So verifying the certificate should not give an error unless your windows machine does not understand the algorithms used for creating/signing the certificate.

One such case is Windows Server 2003 and the SHA-2 family of algorithms. Windows Server 2003 does not understand SHA-2 family of algorithms. I faced this issue recently & the fix was to install a hotfix on the machine which fixes this issue - this is the link for the hotfix.

share|improve this answer

I guess you solved your problem already but this problem happened also to me. I searched a little on the net, and I found the problem.

In my case, the CRLs in the "CRL Distribution Points" wasn't updated. You can see in your Certificate that you have a distribution points which leads you to a directory where all the CRL are located in.

The certificate is confirms that it is not in the CRL, from there.

My certificate was an intermediate CA, and the CRL of our Root CA wasn't updated. So you should check that.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.