I have a pretty straight forward setup: IIS 8 on Windows Server 2012 R2 2x ARR servers with NLB 3x Web content servers in a web farm

ARR servers have IIS shared configuration and IIS web content servers have shared configuration. I am able to sucessfully browse to a domain pointed to my ARR NLB IP over HTTP and hit my web servers in the web farm.

My problem is when I add certificates to the CCS share, they show up with a red X and the error "the specified private key password is not correct.". I have no key password specified in the CCS feature settings, and I generated a CSR and key without encryption to issue these test certificates from a valid CA.

The CSR and key's are all generated through a custom internal SSL utility which is just using OpenSSL. I ran the certificate and key through some validation tools on sslshopper.com and they verified to match and the key was able to be read as it was not encrypted.

I generated the PKCS#12 (.pfx) file using OpenSSL with my un-encrypted key and certificate issued from my CA. I am able to import the generated PFX into my cert store on my local machine, view it, and export it all without issue. Once strange thing I noticed is that when I exported the cert with key from my personal cert store on my machine and added it to the CCS, the error was that the file system could not find the file specified, even though it's displaying the cert with an error which is located in the share.

Any assistance would be greatly appreciated.

Image of error

  • An other solution might be to create your pfx certificate using OpenSSL under Linux. – Ach Oct 29 '18 at 13:02

In regards to the issue you are seeing where it responds with the file system could not find the file specified, we had a similar issue.

Our certificate manager always uses Linux/OpenSSL to create the PFX files, and the output file have missing header information that OpenSSL doesn't care about. The fix for us was to import the cert into CertMgr.msc on Windows and then re-export it to a new PFX; once imported into the CCS, all worked as it should.

| improve this answer | |
  • You are importing the generated PKCS#12 from OpenSSL into CertMgr and then exporting? When I do that, I still get the file system cannot find the file specified. – Shadow00Caster Feb 24 '16 at 20:17
  • This method works IF you import into LOCAL MACHINE store. Do NOT use CURRENT USER store when importing. I suspect that the MachineKeySet flag needs to be set on the SSL certificate, and importing into LOCAL MACHINE store does this automatically, and exporting keeps the MachineKeySet flag. – Grant Jul 9 '17 at 1:24

Even attempting SmithPlatts recommendation, I was still unable to get CCS to recognize the certificate.

I ended up generating a request from IIS, completing the request with a CA provided cert, and then exporting that certificate with key from certmgr. I took that PFX and CCS see's it no problem.

I don't know exactly what the problem is, I suspect it is something along the lines of SmithPlatts post, but unsure. I plan to make some PowerShell scripts to manage this process, not ideal, but it works.

| improve this answer | |
  • How frustrating! Sorry that my suggestion didn't seem to help. I remember we had to do a lot of fussing about to get it to work when OpenSSL was used; but I'm 99% sure that importing to CertMgr, and re-exporting (with private key and full chain) worked for us. – SmithPlatts Feb 25 '16 at 9:56
  • Ah, finally found the link to some information about using non-Windows means to create properly formed CCS-supported certs: cisco.com/c/en/us/td/docs/app_ntwk_services/… – SmithPlatts Feb 25 '16 at 10:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.