Having configured Access management to run under IIS, when I browse to the website I see a page with "HTTP Error 500.30 - ANCM In-Process Start Failure". Going to the logs I find the following:
2020-11-11 17:07:21.2198|Error|Tridion.AccessManagement.Program|Error Tridion.AccessManagement.Common.Exceptions.AccessManagementException: Cannot read certificate 'C:/SDLServices/Access Management/bin/certs/accman.pfx'. ---> Internal.Cryptography.CryptoThrowHelper+WindowsCryptographicException: The specified network password is not correct. at Internal.Cryptography.Pal.CertificatePal.FilterPFXStore(Byte rawData, SafePasswordHandle password, PfxCertStoreFlags pfxCertStoreFlags) at Internal.Cryptography.Pal.CertificatePal.FromBlobOrFile(Byte rawData, String fileName, SafePasswordHandle password, X509KeyStorageFlags keyStorageFlags) at System.Security.Cryptography.X509Certificates.X509Certificate..ctor(String fileName, String password, X509KeyStorageFlags keyStorageFlags) at System.Security.Cryptography.X509Certificates.X509Certificate2..ctor(String fileName, String password, X509KeyStorageFlags keyStorageFlags) at Tridion.AccessManagement.Utils.CertificateHelper.GetCertificate(CertificateDetails settings) in /home/linux-buildagent/vsts-agent/_work/1/s/src/Tridion.AccessManagement/Utils/CertificateHelper.cs:line 22
The private key in the PFX file is created without a password, and I can verify that it's possible to read it by running the following powershell command (I'm logged in as Administrator):
[Security.Cryptography.X509Certificates.X509Certificate]::new( ` "C:/SDLServices/Access Management/bin/certs/accman.pfx", "", "EphemeralKeySet")
Is there a better way to test this?
Google turns up various sites that say that the problem is about private keys being stored in protected storage, and that you can work around it by importing the certificate to the relevant account. So far I have not succeeded, and in any case, I'd prefer not to have to use a cludgy workaround if I ever wish to do this on a production system.
Any information about the correct incantations would be welcome.