Having configured Access management to run under IIS, when I browse to the website I see a page with "HTTP Error 500.30 - ANCM In-Process Start Failure". Going to the logs I find the following:

2020-11-11 17:07:21.2198|Error|Tridion.AccessManagement.Program|Error Tridion.AccessManagement.Common.Exceptions.AccessManagementException: Cannot read certificate 'C:/SDLServices/Access Management/bin/certs/accman.pfx'. ---> Internal.Cryptography.CryptoThrowHelper+WindowsCryptographicException: The specified network password is not correct. at Internal.Cryptography.Pal.CertificatePal.FilterPFXStore(Byte[] rawData, SafePasswordHandle password, PfxCertStoreFlags pfxCertStoreFlags) at Internal.Cryptography.Pal.CertificatePal.FromBlobOrFile(Byte[] rawData, String fileName, SafePasswordHandle password, X509KeyStorageFlags keyStorageFlags) at System.Security.Cryptography.X509Certificates.X509Certificate..ctor(String fileName, String password, X509KeyStorageFlags keyStorageFlags) at System.Security.Cryptography.X509Certificates.X509Certificate2..ctor(String fileName, String password, X509KeyStorageFlags keyStorageFlags) at Tridion.AccessManagement.Utils.CertificateHelper.GetCertificate(CertificateDetails settings) in /home/linux-buildagent/vsts-agent/_work/1/s/src/Tridion.AccessManagement/Utils/CertificateHelper.cs:line 22

The private key in the PFX file is created without a password, and I can verify that it's possible to read it by running the following powershell command (I'm logged in as Administrator):

[Security.Cryptography.X509Certificates.X509Certificate]::new( `
    "C:/SDLServices/Access Management/bin/certs/accman.pfx", "", "EphemeralKeySet")

Is there a better way to test this?

Google turns up various sites that say that the problem is about private keys being stored in protected storage, and that you can work around it by importing the certificate to the relevant account. So far I have not succeeded, and in any case, I'd prefer not to have to use a cludgy workaround if I ever wish to do this on a production system.

Any information about the correct incantations would be welcome.

  • Dominic , can you request to re-issue the certificate and try again – Anand NS Nov 12 at 9:01
  • Is there anything specific that should be in the Certificate Signing Request? – Dominic Cronin Nov 12 at 17:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.