Add Server Certificate in IIS from C#

Hi All,

I wish to import a Certificate from a C# app into IIS.

If I import the file using the IIS manager GUI:
  - Server Certificates
    - Import
It allows me to use this to assign as the SSL certificate in the Site Binding.

Now, if I do the same process within C#, it adds the certificate  - or at least it looks identical - but when I try to assign it as the SSL certificate in the Site Binding, it gives the error:
"A specified logon session does not exist. It may already have been terminated. (Exception from HRESULT: 0x80070520)"

When you view the certificate in the 'Server Certificates' dialog it has identical entries for each of the columns...

The code I am using is as follows:
X509Store store = new X509Store("WebHosting", StoreLocation.LocalMachine);                
store.Open(OpenFlags.OpenExistingOnly | OpenFlags.ReadWrite);
X509Certificate2 certificate = new X509Certificate2(xSSLCertificate, xSSLCertificatePassword);
store.Add(certificate);
store.Close();

Open in new window

Can anyone help?

Thanks,

James
LVL 4
James AtkinSenior Principle Software EngineerAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Dan McFaddenSystems EngineerCommented:
You need to bind the certificate to the site before the call to "store.Close();"

IIS Forum Thread:  https://forums.iis.net/t/1163325.aspx

Other reference links:

- https://forums.iis.net/t/1178407.aspx
- https://msdn.microsoft.com/en-us/library/ms731899(v=vs.110).aspx

Dan
0
James AtkinSenior Principle Software EngineerAuthor Commented:
Hi,

Thank you for your suggestions.

Unfortunately even in this sequence, the same issue persists.

I have now tried simply importing the Certificate using C#, then adding all the Web Site with references using the IIS Manager. As soon as I try to assign the SSL Certificate to the site, I get the same error.

It look like there must be some sort of error in the import process:

String xMachineName = Environment.MachineName;
String xSSLCertificate = @"D:\Cert\ServerSSL.pfx";
String xSSLCertificatePassword = @"TestPassword";
using (ServerManager iisManager = new ServerManager())
{
    X509Store store = new X509Store("WebHosting", StoreLocation.LocalMachine);
    store.Open(OpenFlags.OpenExistingOnly | OpenFlags.ReadWrite);
    X509Certificate2 certificate = new X509Certificate2(xSSLCertificate, xSSLCertificatePassword);
    store.Add(certificate);
    store.Close();
    iisManager.CommitChanges();
}

Open in new window


I cannot see anything obvious here - any ideas?
0
Dan McFaddenSystems EngineerCommented:
There aren't any site binding commands in the code above.

I would read the IIS Forum thread I posted, it gives a code example.

To sudo code it:

1. instantiate object for cert
2. set cert object properties
3. open the local certificate store
4. add the cert to the store
5. connect to the iis web site object
6. add the certificate binding
7. set the binding protocol
8. dispose of objects

Dan
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
The 7 Worst Nightmares of a Sysadmin

Fear not! To defend your business’ IT systems we’re going to shine a light on the seven most sinister terrors that haunt sysadmins. That way you can be sure there’s nothing in your stack waiting to go bump in the night.

James AtkinSenior Principle Software EngineerAuthor Commented:
You are correct, I am currently testing just the automated import of the certificate into the store.
The same as using 'Server Certificates', Right-Click 'Import' within the IIS Manager application.

It does appear to add the entry, ready for binding to a site, however does not allow me to bind the created entry, even within the IIS Manager - same message as I receive when automating the bind.

The Import process does appear to work correctly, and will throw an error is the pwd is wrong, but I am not able to use it afterwards.

I am probably missing something obvious here, but I cannot see it :-(
0
Dan McFaddenSystems EngineerCommented:
Are there any errors in the Event Logs that relate to the attempt to bind the cert in IIS Manager?

If so, can you please post them with all the details?

Dan
0
James AtkinSenior Principle Software EngineerAuthor Commented:
This seems to be okay now!
Not sure what I had missed when I previously tested this.

Many thanks for the help :-)
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
C#

From novice to tech pro — start learning today.