Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Consider a Win2003 + IIS6 machine that has a single website. Let's call it myDomain.com. The task is to secure the site with an SSL certificate. Currently have a .pfx certificate.

Using the MMC app, the certificate is imported successfully into:

  • Current user personal store
  • Local Computer personal store

Problem: the myDomain cert doesn't show in the list of available certs when configuring IIS. The only entry is for that 3rd part certificate authority.

We know the cert for myDomain.com is in the .pfx because the MMC import process shows two certs:

  • one for myDomain.com with the Intended Purpose of Client Authentication
  • one for the Root CA

Question:

How can I ensure that the certificate --for myDomain.com-- in the .pfx shows in the pick-list in the IIS Certificate Wizard when choosing "Assign an existing certificate"?

Update It appears that the .pfx created was not suitable for Server Authentication, but rather Client Authentication only.

alt text alt text alt text

share|improve this question
    
It turned out that the CA issued me a cert that was templated for client only. –  p.campbell Dec 4 '09 at 5:28

1 Answer 1

up vote 1 down vote accepted

I believe you have a certificate of the wrong type the IIS certificate needs to authenticate the server to the client and therefore needs to have the key usage server authentication you indicate it has client authentication. Without more detail its hard to tell but thats what im reading from your text. IIS wont let you pick it as its not suitable is my suggestion.

Where other templates available from the CA, with Server Auth available?

What was the CA type?


share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.