IIS Centralized Certificate Store (CCS) seems to be a nice solution to not having to Import certificates and picking them for a specific binding in IIS.

Unfortunately there seem to be prerequisites to the certificates, which are not well documented and lead to certificates not being picked up - here are my observations:

  • Certs exported from MMC (if imported via MMC before) work.
  • Certs issued by Let-Encrypt do not work - seems the Chain is missing
  • Certificates that are read with powershell and written via Export-PFXCertificate -ChainOption BuildChain have the chain, but are not working either
  • Certs imported via PowerShell and exported via MMC do not work either.
  • Certs exported via MMC are about 150 bytes smaller than those exported via PowerShell

So what are the requirements to those certificates?
Why is import/export via MMC working, but PowerShell import/export won't?
What is missing?
How to solve that with a simple script?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.