Problem with private key for certificates manually imported into Local Computer store

[rterekhovguard]

Looks like Certify The Web 6.1.11 corrupts private keys for certificates imported into Local Computer store.

What I do:

• Generate wildcard certificate (with no deployment)
• Manualy import certificate into Local Computer\Personal store
• Configure IIS to use the certificate (optional)
• After some time (one hour or so) the certificate is no longer usable
• Local Computer\Personal\Certificate -> All Tasks -> Manage Private Keys... shows "No Key found"
• Remove certificate
• Reimport the same certificate again into Local Computer\Personal store
• Certificate is OK for some time, but then its private key is gone again

Uninstalling Certify The Web 6.1.11 fixes the problem

[webprofusion-chrisc]

No, the app imports the certificate to the Local Computer personal store by default but it does it as Local System (not your account).

You should not be manually importing the PFX as you are creating conflicting thumbprints in the certificate store which is likely why you are encountering an "ephemeral key" issue.

[rterekhovguard]

I select "No Deployment" mode on Deployment page for the certificate I generate with the program, so it it not stored in Local Computer store by default. And the problem with the private key happen just after some hours after manual importing into certificate store. This is long before the certificate expire time and possible automatic renewal process.

[webprofusion-chrisc]

Are you importing the pfx on a different computer or the same computer? If it's the same computer you should let the app store the certificate for you.

If you have to manually import, try importing the PFX twice in a row, we have previously seen a bug in windows where keys don't persist until the cert is imported twice and in fact we do that automatically in the app.

[webprofusion-chrisc]

Testing this in our own environment with a similar manual import process we were unable to reproduce the problem.

If you use certutil to analyse your certificate does say "Encrypt test passed"? How are you exporting/getting the PFX file?

certutil -v -dump certificate.pfx

[rterekhovguard]

I am importing pfx fil on the same computer where I use Certify The Web app. The imported certificate is working fine right after importing and during some time after importing. But then, after some hours, it gets the problem with the private key.
Importing pfx file on other computer (without Certify The Web app) works fine. Certificate works also fine if I uninstall Certify The Web app or stops Certify.Service windows service.

If I remove the certificate from the certificate store and then import the same pfx file again it works fine for some hours until the problem repeats.

I use Certify The Web on my development computer, so I dont need renewing or automatisk deployment of the certificates. So I selected "No Deployment" mode on Deployment page.

- Testing this in our own environment with a similar manual import process we were unable to reproduce the problem.
I think this i because it takes some time. Try to wait and check the certificate private key next day for example.
If I double click on the imported cerficate in certificate store it shows that certificate is OK and that it has private key, så everything looks fine, but if I try to use the certificate in IIS it does not work. You can also right click on the certificate in the store and select All Tasks -> Manage Private Keys... This should show you Permissions dialog window for working certificate. When the certificate gets the problem with private key I get Private key not found dialog instead of Permissions dialog, but at the same time if I just open certificate it shows that certificate is OK and it has private key and everithing looks fine there. So to see the problem you need to create IIS website that uses the certificate or check All Tasks -> Manage Private Keys...

- How are you exporting/getting the PFX file?
I double click on cerficate file located in C:\ProgramData\certify\assets folder and select to install it into Local Machine

I want to say that I tested this with a wildcard certificate in case this is important to reproduce the problem.

Yes, when i run certutil -v -dump certificate.pfx it shows Encryption test passed
I think that pfx file is fine. It works right after importing and it works on other computers.
The problem happens only with the certificate imported into certificate store.
I think the problem caused by Certify.Service service that does something with the certificate some time later.

[rterekhovguard]

I just inspected C:\ProgramData\certify\logs\session.log log file and it gets this when the problem comes:

2026-02-02 11:09:37.188 +01:00 [INF] Checking OCSP (where available) for 1 items
2026-02-02 11:09:39.868 +01:00 [INF] Performing Renewal Info checks for 1 items

[webprofusion-chrisc]

Thanks, that's very interesting. Can you try setting "DisableARIChecks" to true in C:\ProgramData\certify\appsettings.json then restart the Certify background service to see fit hat helps. It won't stop the OCSP checks but it will stop the renewal info checks, both processes read the PFX into memory which could be causing something to happen in the Windows internals (a key cleanup).

As a work around you can use the Certificate Store deployment option, which won't update IIS but will store the certificate for you. I suspect if there is a cleanup but it's only affecting manual imports, because otherwise I think we would have heard from thousands of users by now.

[rterekhovguard]

I satt DisableARIChecks to true, but this did not helped. session.log get this:

2026-02-02 13:46:30.883 +01:00 [INF] Checking OCSP (where available) for 1 items
2026-02-02 13:46:33.604 +01:00 [INF] ARI Checks are disabled.

[webprofusion-chrisc]

Thanks for trying that. Can you try upgrading to v7 beta of that app - the current version if about to become the production version with some more minor changes so it would be good to know of the same problem is appearing in that version or not.

[rterekhovguard]

Testet v7 and it does not have the samme issue as v6.
v6 with Certificate Store Only deployment mode works fine as well.

[webprofusion-chrisc]

Thank you for testing that, we will aim to get the production v7 release out this week or next.