I know this question has been asked before and I've gone through countless threads on here (as well as google) trying all of them. Unfortunately, I think I'm having an unrelated issue to what others have had.
I have a CRT and KEY file on our CentOS webserver. It's working fine. We want to use it on our Windows 2008 R2 Standard server for Exchange 2013.
I have verified my keyfile checks out:
# openssl rsa -text -in mydomain.key Private-Key: (4096 bit)
I have attempted to convert it into a PFX:
# openssl pkcs12 -export -out mydomain.pfx -inkey mydomain.key -in mydomain.crt
After converting, I can even test the PFX file to make sure it does contain a private key:
# openssl pkcs12 -in exchange.pfx -nodes Enter Import Password: MAC verified OK Bag Attributes localKeyID: 63 04 21 C5 D8 02 0E E2 A9 A7 6E E4 CD 90 66 1E 27 95 8F 0D friendlyName: My Company SSL subject=/OU=Domain Control Validated/CN=*.mydomain.tld issuer=/C=BE/O=GlobalSign nv-sa/CN=AlphaSSL CA - SHA256 - G2 -----BEGIN CERTIFICATE----- (Redacted, obviously.) -----END CERTIFICATE----- Bag Attributes localKeyID: 63 04 21 C5 D8 02 0E E2 A9 A7 6E E4 CD 90 66 1E 27 95 8F 0D friendlyName: My Company SSL Key Attributes: <No Attributes> -----BEGIN PRIVATE KEY----- (Redacted, obviously.) -----END PRIVATE KEY-----
Exchange allows me to import it, but then it never shows in the ECP. When I try to remove the key through the Exchange Console, this is the error I get:
[PS] C:\Windows\system32>remove-exchangecertificate cmdlet Remove-ExchangeCertificate at command pipeline position 1 Supply values for the following parameters: Thumbprint: 630421C5D8020EE2A9A76EE4CD90661E27958F0D Confirm Are you sure you want to perform this action? Remove certificate with thumbprint 630421C5D8020EE2A9A76EE4CD90661E27958F0D from the computer's certificate store? [Y] Yes [A] Yes to All [N] No [L] No to All [?] Help (default is "Y"): Y A special Rpc error occurs on server TWEXCHANGE: The certificate with thumbprint 630421C5D8020EE2A9A76EE4CD90661E27958F0D was found but is not valid for use with Exchange Server (reason: PrivateKeyMissing). + CategoryInfo : NotSpecified: (:) [Remove-ExchangeCertificate], InvalidOperationException + FullyQualifiedErrorId : [Server=TWEXCHANGE,RequestId=75aa9cfb-6db4-4c0d-aae3-5eaa32eb0389,TimeStamp=3/25/2015 9: 24:49 PM] [FailureCategory=Cmdlet-InvalidOperationException] DE2A4BCA,Microsoft.Exchange.Management.SystemConfigur ationTasks.RemoveExchangeCertificate + PSComputerName : twexchange.mydomain.com
The only way to remove it is to open the MMC, add the Certificate Snap-In and connect to Computer Certificates. I can search by the SHA1 thumbprint and delete it. (If I don't delete it, when I attempt to import it again, I get an error that the thumbprint already exists.)
I've also attempted to convert my PEM key/crt file to DER and import that way:
# openssl x509 -outform der -in mydomain.pem -out mydomain.cer
I have the exact same results in Exchange 2013, it silently imports it, won't display it on the ECP and when I check it in the MMC: it's missing the private key. Any help at this point would be appreciated.