IIS Centralized Certificate Store (CCS) seems to be a nice solution to not having to Import certificates and picking them for a specific binding in IIS.
Unfortunately there seem to be prerequisites to the certificates, which are not well documented and lead to certificates not being picked up - here are my observations:
- Certs exported from MMC (if imported via MMC before) work.
- Certs issued by Let-Encrypt do not work - seems the Chain is missing
- Certificates that are read with powershell and written via
Export-PFXCertificate -ChainOption BuildChainhave the chain, but are not working either
- Certs imported via PowerShell and exported via MMC do not work either.
- Certs exported via MMC are about 150 bytes smaller than those exported via PowerShell
So what are the requirements to those certificates?
Why is import/export via MMC working, but PowerShell import/export won't?
What is missing?
How to solve that with a simple script?