Sorry if this is a duplicate question, but I didn't see anything like my problem. This is also my first time renewing a cert.

So, a bit of backstory. We have a sharepoint site, with a ISA firewall doing web traffic redirection. Our Sharepoint server is not public facing, so we have a cert for a web listener installed to use SSL on incoming traffic, so when people log in, their passwords are not in clear text.

Based on the instructions on the seller's website, you have to generate the Cert Request from the IIS box (sharepoint) but install the cert on ISA (firewall) OK, so far so good.

I am able to export the cert, import it into the computers personal cert store. However when I go to the listener rule on ISA, the new cert is not showing up as valid, it says the private key is invalid or missing.

So here is where I made a mistake somewhere. According to KB 292569

"If you do not have the option to click Yes on the Export Private Keys window, the private key has already been exported to another computer or the key never existed on this computer. You cannot use this certificate on ISA Server. You must request a new certificate for this site for ISA Server."

The cert from the seller, when I right click to export it, doesn't have a option to include the private key.

So according to the MS article, do I need to start over with a new CSR?

What did i miss to cause my cert to not have a private key?

  • You said that you generated a certificate request (CSR). Who generated the actual certificate? Was it you, or this "seller"? If it was you, you have to generate a private key based off the public key.
    – Daisetsu
    Feb 14, 2014 at 19:49
  • What/Who is this "seller" you are referring to?
    – k1DBLITZ
    Feb 14, 2014 at 21:17

2 Answers 2


Where the cert is generated is irrelevant.

You can generate the cert from your workstation, the sharepoint server, or a completely unrelated workstation/server.

The key (ha! I love puns) to getting this all to work is consistency. Where you start is where you need to finish.

For example:

  1. Create the CSR from the Sharepoint server
  2. Submit the CSR to the CA for signing.
  3. The CA will sign the cert and send it back. (this is where you went wrong, I think) The signed cert needs to be imported back to the original machine that generated the CSR via the pending request. (in this example, the Sharepoint server)
  4. You now having a matching key/cert you can export and install on the ISA server. (make sure you export the private key when exporting the cert)

OK, I finally figured out what happened. My boss started this but couldn't get it to work, well it turns out he got mixed up. k1DBLITZ was right, where you start is where you finish, wish my boss knew that :) As I said above, we generated a cert request one one box, with the ISA firewall secure redirect. That's because this is the server that the public will see. Then we have a different server that is the web host.

Well, my boss generated a cert request on the web server, but then tried to finish the cert by installing the cert response on ISA server not the web server. Once I figured out what he did, I just installed the response on the server that generated the request and completed the cert. After that I could export the cert, with the private key, onto the ISA firewall box.

Anyway, once I figured what he did, it was simple to fix. 100% human error. Thanks guys!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.