In Windows 2003 it was simple to do and one could use the winhttpcertcfg.exe (download) to give "NETWORK SERVICE" account access to a certificate.

I'm now using Windows Server 2008 R2 with IIS 7.5 and I am unable to find where and how to set permissions access permissions to a certificate in the certificate store. This Post showed how to do it in Vista and that winhttpcertcfg features were added into the certificates mmc however it doesn't seem to work with imported certificates or doesn't work anymore on Server 2008 R2.

So does anyone have any idea on how give IIS 7.5 the correct permissions to read a certificate from the certificate store? And also what account from IIS 7.5 that needs the permission.

migrated from stackoverflow.com Apr 9 '10 at 17:44

This question came from our site for professional and enthusiast programmers.

  1. Create / Purchase certificate. Make sure it has a private key.
  2. Import the certificate into the "Local Computer" account. Best to use Certificates MMC. Make sure to check "Allow private key to be exported"
  3. Based upon which, IIS 7.5 Application Pool's identity use one of the following.

    • IIS 7.5 Website is running under ApplicationPoolIdentity. Using Certificates MMC, added "IIS AppPool\AppPoolName" to Full Trust on certificate in "Local Computer\Personal". Replace "AppPoolName" with the name of your application pool.
    • IIS 7.5 Website is running under NETWORK SERVICE. Using Certificates MMC, added "NETWORK SERVICE" to Full Trust on certificate in "Local Computer\Personal".
    • IIS 7.5 Website is running under MyIISUser local computer user account. Using Certificates MMC, added "MyIISUser" (a new local computer user account) to Full Trust on certificate in "Local Computer\Personal".

To add a user to Full Trust of a certificate. Right click the certificate -> All Tasks -> Manage Private Keys

  • 2
    Right-click All Tasks only gives me Open or Export... :( – Ian Grainger Aug 26 '14 at 11:09

The answer of Thames is a good answer but it causes also a problem. I have a .P12 file that also includes the 'trusted root Certification Authories' and a 'intermdediate Certification Authories' and when you explicit put the certificates in "local computer\personal' those two additional certificates are not found (without any notification / exceptions) and the request will fail

  • what if you automatically let it import the certificates? do the go in the correct places? – thames Jul 21 '10 at 22:00
  • @thames: I have a similar problem and if I import certificate into Trusted roots or set it to automatically select appropriate store it gets to trusted roots. I can't set trust permissions on these certificates... One can only set private key permissions on personal certificates and not in other stores. Any suggestions? Also check my question on Stackoverflow. – Robert Koritnik May 14 '12 at 9:27
  • 1
    @RobertKoritnik: I answered your question on Stackoverflow. Though not sure if it'll work in your situation as I haven't tried it. stackoverflow.com/questions/10580326/… – thames May 15 '12 at 4:26

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.