2

Having configured Access management to run under IIS, when I browse to the website I see a page with "HTTP Error 500.30 - ANCM In-Process Start Failure". Going to the logs I find the following:

2020-11-11 17:07:21.2198|Error|Tridion.AccessManagement.Program|Error Tridion.AccessManagement.Common.Exceptions.AccessManagementException: Cannot read certificate 'C:/SDLServices/Access Management/bin/certs/accman.pfx'. ---> Internal.Cryptography.CryptoThrowHelper+WindowsCryptographicException: The specified network password is not correct. at Internal.Cryptography.Pal.CertificatePal.FilterPFXStore(Byte[] rawData, SafePasswordHandle password, PfxCertStoreFlags pfxCertStoreFlags) at Internal.Cryptography.Pal.CertificatePal.FromBlobOrFile(Byte[] rawData, String fileName, SafePasswordHandle password, X509KeyStorageFlags keyStorageFlags) at System.Security.Cryptography.X509Certificates.X509Certificate..ctor(String fileName, String password, X509KeyStorageFlags keyStorageFlags) at System.Security.Cryptography.X509Certificates.X509Certificate2..ctor(String fileName, String password, X509KeyStorageFlags keyStorageFlags) at Tridion.AccessManagement.Utils.CertificateHelper.GetCertificate(CertificateDetails settings) in /home/linux-buildagent/vsts-agent/_work/1/s/src/Tridion.AccessManagement/Utils/CertificateHelper.cs:line 22

The private key in the PFX file is created without a password, and I can verify that it's possible to read it by running the following powershell command (I'm logged in as Administrator):

[Security.Cryptography.X509Certificates.X509Certificate]::new( `
    "C:/SDLServices/Access Management/bin/certs/accman.pfx", "", "EphemeralKeySet")

Is there a better way to test this?

Google turns up various sites that say that the problem is about private keys being stored in protected storage, and that you can work around it by importing the certificate to the relevant account. So far I have not succeeded, and in any case, I'd prefer not to have to use a cludgy workaround if I ever wish to do this on a production system.

Any information about the correct incantations would be welcome.

2
  • Dominic , can you request to re-issue the certificate and try again
    – Anand NS
    Nov 12 '20 at 9:01
  • Is there anything specific that should be in the Certificate Signing Request?
    – Dominic Cronin
    Nov 12 '20 at 17:09
1

I have installed Access Management in both service and IIS and tested with this script to generated the new Self Signed Certificate and used it's working fine as expected, you can also modify this script to generate the existing signed certificate for the issued from a certificate authority (CA), you just need thumbprint number of the certificate then easy to Export Pfx Certificate.

Example for generating self-signed certificate:

    $installAccessManagementServiceScriptRoot = "D:\AccessManagementService"
    $certPassword = "tridion"
    
    cd $installAccessManagementServiceScriptRoot
    
    New-Item -Path “.\bin\Certificates” -ItemType Directory | Out-Null
    
    $cert = New-SelfSignedCertificate -certstorelocation Cert:\LocalMachine\My -dnsname $env:COMPUTERNAME
    
    $pwd = ConvertTo-SecureString -String $certPassword -Force -AsPlainText
    
    $AccessManagementCertificate = $installAccessManagementServiceScriptRoot + "\bin\Certificates\TridionAccessManagement.pfx"
    
    $path = 'Cert:\LocalMachine\My\' + $cert.thumbprint 
    
    Export-PfxCertificate -cert $path -FilePath $AccessManagementCertificate -ChainOption BuildChain -NoProperties -Password $pwd       

I hope it helps.

0

I was able to find an answer on Stack Overflow which seems to be the correct approach. https://stackoverflow.com/a/10048789/9967

After setting Load User Profile to true on the application pool, the Access Management site worked correctly.

Seeing Velu's answer, I wonder if this is necessary for a self-signed certificate. In my case I had used a certificate generated from a certificate authority.

Screen capture showing the "Load User Profile" Application Pool setting

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.