I'm trying to install an automatically renewed SSL certificate on IIS running on Windows Server 2022. I downloaded the IIS files from the certificate provider's ZIP, installed the intermediate certificate in the appropriate store, and updated the IIS binding. The renewed certificate appears to have the new validity dates, but Chrome still reports "Your connection is not private" with NET::ERR_CERT_AUTHORITY_INVALID.
When I try to follow the installation and export instructions, the option to export the private key or create a PFX file is unavailable or greyed out. This certificate has been renewed using the same general process for several years, but the current renewal is not working. Is the original private key from the CSR required, and would re-keying or reissuing the certificate be the best way to start over?
2 Answers
NET::ERR_CERT_AUTHORITY_INVALID usually means the client cannot build a trusted chain. Open the certificate in IIS or a browser and check the Certification Path for errors. Make sure the exact intermediate certificate required by the renewed certificate is installed in the Local Computer intermediate store, not only under the current user. Also verify that IIS is serving the correct certificate and that the binding uses the renewed certificate. Installing a random or outdated intermediate will not fix the chain.
The certificate response must be installed on the same server, or in the same certificate store, where the original CSR and private key were created. A .crt file downloaded from the provider does not contain the private key by itself. If Windows says the private key is unavailable and the PFX export option is disabled, the certificate is not paired with its matching key. In that case, create a new CSR in IIS, re-key or reissue the certificate, install the returned certificate response, and then export or use the resulting certificate with its private key.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures