PrivateKeyNotAccessible (ES2K7)

CKone

unread,

Dec 12, 2007, 4:29:02 PM12/12/07

to

I'm experiencing an odd problem since I generated an Exchange certificate
(using New-ExchangeCertificate) for my internet domain (for which I was
getting Event messages). Although I appear to have resolved the initial
problem, it's created a whole new problem. Initially, it presented as:
---
SmtpReceive Event ID: 1037

Inbound direct trust certificate with thumbprint <hex no> has expired. Run
New-ExchangeCertificate to generate a new direct trust certificate.
---
I followed the instructions at
http://technet.microsoft.com/en-us/library/bb510126.aspx, sure enough, no
SMTP service in the Get-ExchangeCertificate list and granted the appropriate
permissions to Network Service on C:\Documents and Settings\All
Users\Application Data\Microsoft\Crypto\RSA\MachineKeys.

Now I get the following error when trying to add the SMTP service using
Enable-ExchangeCertificate:
---
[PS] C:\Documents and Settings\Administrator>Enable-ExchangeCertificate
-Thumbprint <HexNo> -Services:SMTP
WARNING: An unexpected error has occurred and a Watson dump is being
generated:
The certificate with thumbprint <HexNo> was found but is not valid for
usage with Exchange Server (reason: PrivateKeyNotAccessible).
Enable-ExchangeCertificate : The certificate with thumbprint <HexNo> was
found but is not valid for usage with Exchange Server (reason:
PrivateKeyNotAccessible).
At line:1 char:27
+ Enable-ExchangeCertificate <<<< -Thumbprint <hexNo> -Services:SMTP

Does anyone have any ideas? I've Googled the PrivateKeyNotAccessible key
word, and sure enough there is a single match, in the TechNet Russia forums,
which are currently throwing up a System Error when I try to access it...

Thanks in advance

D

JoshP

unread,

Dec 12, 2007, 11:40:03 PM12/12/07

to

You are going to have to delete the existing key and regenerate a CSR on your
Exchange server. You will have to rekey your certificate (hopefully your
cert provider allows free rekeys). Your cerfiticate store must have changed
after your created your CSR (i.e. New-ExchangeCertificate).

CKone

unread,

Dec 13, 2007, 2:34:06 AM12/13/07

to

Josh

Thanks for your reply. I'm not sure what a "CSR" is? However,
Remove-ExchangeCertificate causes the same message as below. Running
Get-ExchangeCertificate | FL * now results in no certificates being returned.

D

JoshP

unread,

Dec 13, 2007, 10:28:01 AM12/13/07

to

Here's your process (ex. for CompanyA with OWA etc. at mail.example.com:

New-ExchangeCertificate -GenerateRequest -SubjectName "C=ComapanyA,
O=CompanyA, CN=mail.example.com" -DomainName mail.example.com,
autodiscover.example.com, autodiscover.example.local, exchange.example.local,
exchange -FriendlyName "EXCHANGE - SERVICES CERT" -KeySize 1024 -Path
C:\exch_srvc_cert.txt -PrivateKeyExportable:$true

Now use the text located in exch_srvc_cert.txt to recieve a certificate
(through a 3rd party or enterprise CA).

Then,

Import-ExchangeCertificate -Path c:\returned_cert.crt |
Enable-ExchangeCertificate -Services IIS

When you run the New-ExchangeCertificate command, a Certificate Signing
Request is generated in addition to the "private key" for the request is
automatically stored on the exchange server. If you made any changes to the
certificates on your exchange server after you executed the
New-ExchangeCertificate command and before you executed the
Import-ExchangeCertificate command--could lead to the PrivateKey issue you
are seeing.

CKone

unread,

Dec 13, 2007, 12:44:02 PM12/13/07

to

Thanks for that Josh.

Will that solve the problem of the "bad" certificate currently in the
certificate store?

D

JoshP

unread,

Dec 13, 2007, 12:47:00 PM12/13/07

to

You should be able to remove all other certificates after you have a valid
certificate assigned.

CKone

unread,

Dec 13, 2007, 1:56:03 PM12/13/07

to

Josh, I just tried your suggestion.

The following gives the error:

New-ExchangeCertificate : Cannot overwrite the output file
C:\certs\exch_srvc_cert.txt. It may be only readonly.
At line:1 char:24

(I granted everyone Full Control on the c:\certs folder to ensure there
wasn't a permissions problem).

Any ideas?

D

JoshP

unread,

Dec 13, 2007, 2:01:04 PM12/13/07

to

Change permissions on

c:\documents and settings\all users\application
data\microsoft\crypto\rsa\machinekeys

go to security, select advanced, select the administrators group (which
should already have full access) and change the setting from "this folder
only" to "this folder, subfolders and files".

WorkingHard

unread,

Dec 13, 2007, 2:20:38 PM12/13/07

to

use the -force parameter

"CKone" <CK...@discussions.microsoft.com> wrote in message
news:41CC3335-AA10-4CB8...@microsoft.com...

Message has been deleted