21

In Windows 2003 it was simple to do and one could use the winhttpcertcfg.exe (download) to give "NETWORK SERVICE" account access to a certificate.

I'm now using Windows Server 2008 R2 with IIS 7.5 and I am unable to find where and how to set permissions access permissions to a certificate in the certificate store. This Post showed how to do it in Vista and that winhttpcertcfg features were added into the certificates mmc however it doesn't seem to work with imported certificates or doesn't work anymore on Server 2008 R2.

So does anyone have any idea on how give IIS 7.5 the correct permissions to read a certificate from the certificate store? And also what account from IIS 7.5 that needs the permission.

thames
  • 925
  • 2
  • 9
  • 20

1 Answers1

38
  1. Create / Purchase certificate. Make sure it has a private key.
  2. Import the certificate into the "Local Computer" account. Best to use Certificates MMC. Make sure to check "Allow private key to be exported"

  3. Based upon which, IIS 7.5 Application Pool's identity use one of the following.

    • IIS 7.5 Website is running under ApplicationPoolIdentity. Using Certificates MMC, added "IIS AppPool\AppPoolName" to Full Trust on certificate in "Local Computer\Personal". Replace "AppPoolName" with the name of your application pool.
    • IIS 7.5 Website is running under NETWORK SERVICE. Using Certificates MMC, added "NETWORK SERVICE" to Full Trust on certificate in "Local Computer\Personal".
    • IIS 7.5 Website is running under MyIISUser local computer user account. Using Certificates MMC, added "MyIISUser" (a new local computer user account) to Full Trust on certificate in "Local Computer\Personal".

To add a user to Full Trust of a certificate. Right click the certificate -> All Tasks -> Manage Private Keys

ΩmegaMan
  • 103
  • 4
thames
  • 925
  • 2
  • 9
  • 20
  • 3
    Right-click All Tasks only gives me Open or Export... :( – Ian Grainger Aug 26 '14 at 11:09
  • 1
    @IanGrainger I'm guessing you're not running as admin or aren't managing machine keys. – user12861 May 26 '20 at 21:08
  • Point no 2 helped me to solve the issue with unable to read private key of the certificate and the app pool account access issue, i missed this while Import the certificate , removed the certificate and imported the certificate again with Allow private key to be exported option checked . the issue resolved . Thanks for this. – Esaki Oct 06 '20 at 08:58