Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Consider a Win2003 + IIS6 machine that has a single website. Let's call it The task is to secure the site with an SSL certificate. Currently have a .pfx certificate.

Using the MMC app, the certificate is imported successfully into:

  • Current user personal store
  • Local Computer personal store

Problem: the myDomain cert doesn't show in the list of available certs when configuring IIS. The only entry is for that 3rd part certificate authority.

We know the cert for is in the .pfx because the MMC import process shows two certs:

  • one for with the Intended Purpose of Client Authentication
  • one for the Root CA


How can I ensure that the certificate --for in the .pfx shows in the pick-list in the IIS Certificate Wizard when choosing "Assign an existing certificate"?

Update It appears that the .pfx created was not suitable for Server Authentication, but rather Client Authentication only.

alt text alt text alt text

share|improve this question
It turned out that the CA issued me a cert that was templated for client only. – p.campbell Dec 4 '09 at 5:28
up vote 1 down vote accepted

I believe you have a certificate of the wrong type the IIS certificate needs to authenticate the server to the client and therefore needs to have the key usage server authentication you indicate it has client authentication. Without more detail its hard to tell but thats what im reading from your text. IIS wont let you pick it as its not suitable is my suggestion.

Where other templates available from the CA, with Server Auth available?

What was the CA type?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.