Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to import a certificate to IIS. Everything is ok on the MMC (Windows Console). I finished the wizards and seems that is all right. But, when I refresh the certificate list or move to other screen of IIS, the certificate disappear from the list.

I don't have idea what is the problem. What can I do?

share|improve this question

10 Answers 10

This issue happens when the imported cert does not have a private key associated. If someone is trying to import a domain level certificate to IIS, then we cannot import if the certificate does not have a private key associated and will cause certificate disappears on refresh.

Solution would be to import the .CER file to your system(from where certificate is requested) personel store and export it with private key. Then copy the .pfx file to required server and import it from server certificate option under IIS. This would fix the issue.

share|improve this answer

Is this in IIS 6 or IIS 7? Did you import it in the MMC console or in IIS? Try importing it in the MMC console first, and then selecting it in IIS. Also, make sure that the file you are importing is a .pfx file that includes the private key.

share|improve this answer

I have had this problem multiple times. If using a NetworkSolutions SSL the fix is:

  1. Go to MMC Certificate Manager.
  2. View Personal Certificates and delete the certificate that is "Disappearing".
  3. Then view the "Certificate Enrollment Requests" and right click to export.
  4. Select "Yes, export with private key.

This will allow you to export .pfx file that you can import from IIS 7 manager. Remember to go back to MMC Certificate Manager and select "Personal Certificates" and within properties add the "Friendly Name" back in so it shows within the IIS Manager.

share|improve this answer
    
My solution is dragging the Certificates which has private key from "Intermediate certification authority" to "Personal Certificates" in mmc by pressing Ctrl (Copy Cert) – Bruce May 11 '15 at 4:48

If the server does not have a private key associated for the imported certificate the certificate disappears on refresh (and also it won't be available for bindings).

You can check in the mmc - Certificates - Personal store, and confirm that the certificate was installed but its missing a private key.

If you have a PFX (private key) and password you can import it (as other said), but if you just made a certificate request probably you won't have it.

Supposing that you are on the correct server (the same where you requested the certificate), probably the private key got corrupted somehow. You can open the public certificate, get the serial number, and try to restore the private key from the key store like described here.

share|improve this answer

Use the cert manager to import the file. From there, try to export. If you can't export as a PFX file, I believe that means there's no private key in the cert. You may have downloaded the wrong one from your CA. I'm dealing with our CA now, so I'm not 100% certain about this yet.

share|improve this answer

So, after struggling with this for a few hours, redownloading the cert spending time on the phone with tech support,and looking at every blog I could find, I was stumped. I tried resubmitting the cert request to regenerate the cert (no luck). With a last ditch effort I regenerated the cert request and rekeyed the cert and now it works fine. I don't know what happened and I was very careful keying in my data both times. My solution was simply to generate a new request and rekey the cert.

share|improve this answer
    
I just want to second what Dave wrote: rekeying the certificate. I had the problem that was probably caused by importing a wrong certificate in MMC (A certificate of Intermediate Certification Authority is supposed to be imported using MMC, but I imported the certificate for the web site instead). I deleted it after I realized it, but nothing helped until I regenerated a CSR per the instructions of our CA (godaddy which tech support is great) and imported the rekeyed certificate in IIS. – user51945 Aug 22 '10 at 2:47

I have the same problem with an IIS cert (w/ private key, .pfx) after importing into the MMC Local/Personal/Certificate node on a Windows server 2008R2 machine.

The cert imports fine, says it's good with CA that is also good. I can then configure my proxy server (TMG 2010) to use the cert in a web listener. Everything works great and the web listener and subsequent rules that use the listener all work fine.

After some time, I haven't tried to time it yet, the cert disappears from the MMC L/P/C node. My TMG listener still shows that cert as being the one it's configured to use, but the actual cert is gone.

share|improve this answer

I've found the problem can be reproduced when the leaf certificate has been installed under Intermediate Certification Authorities. Removing it (and leaving any real intermediate, if applicable) then completing the wizard corrects the problem.

share|improve this answer

I had this problem as well and resolved it by using OpenSSL to create the correct .pfx file. Instructions for this can be found here

share|improve this answer

As Sandeep said, IIS deletes your cert if it does not have a private key. This often occurs if you use IIS to create a Certificate Request from a CA. Your CA does not have your private key (you do) so the file does not contain the private key. He are the exact steps you need to do:

You originally created a Certificate Request from IIS on your Server. You sent the request TXT file to your Certificate Authority so they could create the certificate for you.

Your Certificate Authority sent you back a .CRT file On the same Windows Server you used to create the Certificate Request, In Windows Explorer, right-mouse click on the .CRT file your Certificate Authority sent to you.

Select Install Certificate The Certificate Import Wizard runs

In the Certificate Import Wizard, in Store Location, select Local Machine

Next Select Place all certificates in the following store and select Trusted Root Certificate Authorities

OK This causes Windows to import the certificate into Windows (not into IIS). Now you need to get the PFX file that contains the private key:

Launch Mmc

File - Add/Remove Snap-in…

Certificates (Local Computer)

From Certificates (Local Computer) - expanded Trusted Root Certification

Authorities folder

Selected Certificates

Noticed my imported certificate with a key logo displayed on it

Open the certificate

Notice that it displays "You have a private key that corresponds to this certificate."

Ok

Right-mouse click on the certificate.

All Tasks --> Export

Next

In the "Export Private Key" page of the wizard, select "Yes, export the private key"

Next

Certificate Export Wizard prompts you -- Export File Format PKCS #12 (.PFX)

Next

Certificate Export Wizard requires you to protect the file with a password:

Enter a password with which to protect the file.

Next

Browse to a location and provide file name. File will have .PFX extension.

Then, Open IIS 7

Select your IIS Server in left (Connections) pane

Click Open Server Certificates in the Features view

From right side "Actions" pane, click Import…

Select the PFX file you exported

Provide the password you used to protect it

Click OK

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.