Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I tried the whole day just to import a certificate in Windows XP, but I always failed. I did following:

  1. Create the certificate with a private key (no password):

    makecert -sr LocalMachine -ss My -pe -sky exchange -n "CN=TestCert" -a sha1 -sv TestCert.pvk TestCert.cer
  2. Then put the certificate and private key together into a pfx file:

    pvk2pfx.exe -pvk TestCert.pvk -spc TestCert.cer -pfx TestCert.pfx
  3. Import the pfx file with a command-line tool (German system):

    winhttpcertcfg.exe -I TestCert.pfx -a NT-AUTORITÄT\NETZWERKDInternet ExplorerNST -c LOCAL_MACHINE\My
    Error:  Unable to import contents of PFX file.
        Please make sure the filename and path,
        as well as the password, are correct.

    Hint: "NT-AUTORITÄT\NETZWERKDInternet ExplorerNST" --> "NT-AUTHORITY\NETWORKSERVICE"
    Filename is OK, and the password was not set. Even if I set the password (e.g. "MyPassword") in Step 1 and type at the end of step 3:

    ... -p MyPassword

I got the same error. Then I tried to import in the certificate console (mmc with certificate snap-in). There I got following error: "Der private Schlüssel, den Sie importieren, erfordert möglicherweise einen Dienstanbieter, der nicht installiert ist." --> "The imported private key may require a service-supplier which is not installed". But the Microsoft Crypto-Service is up and running.

What else can I do?
On Windows Vista and Windows 7, I got this running without these problems.
I need this certificate to run a WCF service.

share|improve this question

1 Answer 1

Meanwhile, I found the reason for the Problem.

Some days before trying to import certificates with private keys, I changed the directory access rights of the location where the private keys are stored. I did following:

cacls "C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft\Crypto\RSA\MachineKeys" /E /G "NT-AUTORITÄT\NETZWERKDIENST":R

After that I was no longer able to import certificates containing private keys. As soon as I revoked this particular access right the import of certificates worked well.

I do not understand, why adding an access right will result in practically less access rights.

However, I hope this may help someone of you running into same problem.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.