Create certificate failed in SBS2012 (all authorization result: valid) #741

Mangaard · 2018-02-10T17:55:24Z

Issue description

Create certificate failed
But following Files could be found in "C:\ProgramData\letsencrypt-win-simple\httpsacme-v01.api.letsencrypt.org" :
1,4,5,6,7-chain.pem
1,4,5,6,7-crt.der
1,4,5,6,7-crt.pem
ca-1,4,5,6,7-crt.der
ca-1,4,5,6,7-crt.pem
1,4,5,6,7-csr.pem
1,4,5,6,7-gen-csr.json
1,4,5,6,7-gen-key.json
1,4,5,6,7-key.pem

Steps to reproduce

PS C:\Windows\system32> C:\Users\Public\Downloads\letsencrypt-win-simple.v1.9.8.4\letsencrypt.exe
[DBUG] Options: Options {BaseUri="https://acme-v01.api.letsencrypt.org/", Test=False, Verbose=False, Renew=False, ForceRenewal=False, Plugin=null, SiteId=null,
ExcludeBindings=null, HideHttps=False, ManualHost=null, ManualTargetIsIIS=False, Validation=null, ValidationMode="http-01", WebRoot=null, ValidationSiteId=null
, Warmup=False, UserName=null, Password=null, AzureTenantId=null, AzureClientId=null, AzureSecret=null, AzureSubscriptionId=null, AzureResourceGroupName=null, D
nsCreateScript=null, DnsDeleteScript=null, KeepExisting=False, CentralSslStore=null, CertificateStore=null, Installation=[], InstallationSiteId=null, SSLPort=44
3, Script=null, ScriptParameters=null, CloseOnFinish=False, NoTaskScheduler=False, UseDefaultTaskUser=False, Cancel=False, AcceptTos=False, EmailAddress=null}
[DBUG] Config folder: C:\ProgramData\letsencrypt-win-simple\httpsacme-v01.api.letsencrypt.org

[INFO] Let's Encrypt Windows Simple (LEWS)
[INFO] Software version 198.4.6605.15190 (RELEASE)
[INFO] IIS version 7.5
[INFO] ACME Server https://acme-v01.api.letsencrypt.org/
[INFO] Please report issues at https://github.com/Lone-Coder/letsencrypt-win-simple

[DBUG] Renewal period: 55

N: Create new certificate
M: Create new certificate with advanced options
L: List scheduled renewals
R: Renew scheduled
S: Renew specific
A: Renew all
V: Revoke certificate
C: Cancel scheduled renewal
X: Cancel all scheduled renewals
Q: Quit

Please choose from the menu: m

[INFO] Running in Advanced mode

1: Single binding of an IIS site
2: SAN certificate for all bindings of an IIS site
3: SAN certificate for all bindings of multiple IIS sites
4: Manually input host names
C: Cancel

Which kind of certificate would you like to create?: 3

[DBUG] Scanning IIS sites
[INFO] No valid hosts found for SBS SharePoint.
[INFO] No valid hosts found for SharePoint Central Administration v4.
[INFO] No valid hosts found for SharePoint Web Services.
[INFO] No valid hosts found for WSUS-Verwaltung.

1312694709: Companyweb (1 bindings) [@C:\inetpub\wwwroot\wss\VirtualDirectories\Companyweb80]
1: Default Web Site (4 bindings) [@C:\inetpub\wwwroot]
7: Mangaard.de (1 bindings) [@C:\Web-Hosting\www.mangaard.de]
2: SBS Client Deployment Applications (2 bindings) [@C:\Program Files\Windows Small Business Server\Bin\webapp\ClientDeployment]
6: www.magneticpower.de (3 bindings) [@C:\Web-Hosting\www.magneticpower.de]
4: www.Mangaard.ch (3 bindings) [@C:\Web-Hosting\www.Mangaard.ch]
5: www.Mangaard-Physio.de (3 bindings) [@C:\Web-Hosting\www.Mangaard-Physio.de]

Enter a comma separated list of site IDs, or 'S' to run for all sites: 1,4,5,6,7

mangaard-informatik.de
www.mangaard-informatik.de
remote.mangaard-informatik.de
mail.mangaard-informatik.de
www.mangaard.ch
mangaard.ch
mail.mangaard.ch
www.mangaard-physio.de
mangaard-physio.de
mail.mangaard-physio.de
www.magneticpower.de
magneticpower.de
mail.magneticpower.de
mangaard.de

Press enter to include all listed hosts, or type a comma-separated lists of exclusions:

[INFO] Plugin IISSites generated target [IISSites] 1,4,5,6,7 [14 bindings - mangaard-informatik.de, ...]

1: [dns-01] Azure DNS
2: [dns-01] Run external program/script to create and update records
3: [http-01] Create temporary application in IIS
4: [http-01] Save file on local (network) path
5: [http-01] Upload verification file to FTP(S) server
6: [http-01] Self-host verification files (recommended)
7: [http-01] Upload verification file to WebDav path
C: Cancel

How would you like to validate this certificate?: 6

1: Create or update IIS bindings
2: Run external script
3: Do not run any installation steps
C: Cancel

Which installer should run for the certificate?: 3

[DBUG] Scanning IIS sites
[DBUG] Loading signer from C:\ProgramData\letsencrypt-win-simple\httpsacme-v01.api.letsencrypt.org\Signer
[DBUG] Getting AcmeServerDirectory
[DBUG] Send GET request to https://acme-v01.api.letsencrypt.org/directory
[DBUG] Loading registration from C:\ProgramData\letsencrypt-win-simple\httpsacme-v01.api.letsencrypt.org\Registration
[INFO] Authorize identifier: mangaard-informatik.de
[DBUG] Send POST request to https://acme-v01.api.letsencrypt.org/acme/new-authz
[INFO] Cached authorization result: valid
[INFO] Authorize identifier: www.mangaard-informatik.de
[DBUG] Send POST request to https://acme-v01.api.letsencrypt.org/acme/new-authz
[INFO] Cached authorization result: valid
[INFO] Authorize identifier: remote.mangaard-informatik.de
[DBUG] Send POST request to https://acme-v01.api.letsencrypt.org/acme/new-authz
[INFO] Cached authorization result: valid
[INFO] Authorize identifier: mail.mangaard-informatik.de
[DBUG] Send POST request to https://acme-v01.api.letsencrypt.org/acme/new-authz
[INFO] Cached authorization result: valid
[INFO] Authorize identifier: mangaard.de
[DBUG] Send POST request to https://acme-v01.api.letsencrypt.org/acme/new-authz
[INFO] Cached authorization result: valid
[INFO] Authorize identifier: www.magneticpower.de
[DBUG] Send POST request to https://acme-v01.api.letsencrypt.org/acme/new-authz
[INFO] Cached authorization result: valid
[INFO] Authorize identifier: magneticpower.de
[DBUG] Send POST request to https://acme-v01.api.letsencrypt.org/acme/new-authz
[INFO] Cached authorization result: valid
[INFO] Authorize identifier: mail.magneticpower.de
[DBUG] Send POST request to https://acme-v01.api.letsencrypt.org/acme/new-authz
[INFO] Cached authorization result: valid
[INFO] Authorize identifier: www.mangaard.ch
[DBUG] Send POST request to https://acme-v01.api.letsencrypt.org/acme/new-authz
[INFO] Cached authorization result: valid
[INFO] Authorize identifier: mangaard.ch
[DBUG] Send POST request to https://acme-v01.api.letsencrypt.org/acme/new-authz
[INFO] Cached authorization result: valid
[INFO] Authorize identifier: mail.mangaard.ch
[DBUG] Send POST request to https://acme-v01.api.letsencrypt.org/acme/new-authz
[INFO] Cached authorization result: valid
[INFO] Authorize identifier: www.mangaard-physio.de
[DBUG] Send POST request to https://acme-v01.api.letsencrypt.org/acme/new-authz
[INFO] Cached authorization result: valid
[INFO] Authorize identifier: mangaard-physio.de
[DBUG] Send POST request to https://acme-v01.api.letsencrypt.org/acme/new-authz
[INFO] Cached authorization result: valid
[INFO] Authorize identifier: mail.mangaard-physio.de
[DBUG] Send POST request to https://acme-v01.api.letsencrypt.org/acme/new-authz
[INFO] Cached authorization result: valid
[DBUG] Certificate folder: C:\ProgramData\letsencrypt-win-simple\httpsacme-v01.api.letsencrypt.org
[DBUG] Certificate store: My
[DBUG] RSAKeyBits: 2048
[INFO] Requesting certificate 1,4,5,6,7 2018.2.10 5:41:52
[DBUG] Send POST request to https://acme-v01.api.letsencrypt.org/acme/new-cert
[INFO] Saving certificate to C:\ProgramData\letsencrypt-win-simple\httpsacme-v01.api.letsencrypt.org
[EROR] Create certificate failed

N: Create new certificate
M: Create new certificate with advanced options
L: List scheduled renewals
R: Renew scheduled
S: Renew specific
A: Renew all
V: Revoke certificate
C: Cancel scheduled renewal
X: Cancel all scheduled renewals
Q: Quit

Please choose from the menu:

Client version: letsencrypt-win-simple.v1.9.8.4
Windows version: Small Business Server 2011 Standard
Relevant part of log file:

what am I dooing wrong?

Using the Client "Certify The Web" I get all the Certificates installed, but this is not useable in IIS 7.5 - he I Need a SAN Certificate.

WouterTinus · 2018-02-11T11:20:17Z

Looking at the source code and your log, this seems to fail during the conversion of the private key to the Microsoft RSA SChannel Cryptographic Provider, which may not be installed or disabled on your system. We might be able to diagnose that with more certainty if you post a log with --verbose.

I haven't encountered this problem before, but I'll make sure to add better error handling and a fallback to the default provider in the next release of LEWS. Thanks for reporting this bug!

Mangaard · 2018-02-11T15:51:50Z

Thanks for the answer,
"Microsoft RSA SChannel Cryptographic Provider" is installed and enabled - see copy of Result in Powershell:
PS C:\Users\Public\Downloads\letsencrypt-win-simple.v1.9.8.4\scripts> Get-CSP

Name Type

Microsoft Base Cryptographic Provider v1.0 RSA Full (Signature and Key Exchange)
Microsoft Base DSS and Diffie-Hellman Cryptographic Provider DSS Signature with Diffie-Hellman Key Exchange
Microsoft Base DSS Cryptographic Provider DSS Signature
Microsoft Base Smart Card Crypto Provider RSA Full (Signature and Key Exchange)
Microsoft DH SChannel Cryptographic Provider Diffie-Hellman SChannel
Microsoft Enhanced Cryptographic Provider v1.0 RSA Full (Signature and Key Exchange)
Microsoft Enhanced DSS and Diffie-Hellman Cryptographic Provider DSS Signature with Diffie-Hellman Key Exchange
Microsoft Enhanced RSA and AES Cryptographic Provider RSA Full and AES
Microsoft RSA SChannel Cryptographic Provider RSA SChannel
Microsoft Strong Cryptographic Provider RSA Full (Signature and Key Exchange)

Maybee Process is interferred throuh installed Certsrv.
## certutil -getconfig
Konfiguration: "MNG-SBS2012.mib.local\mib-MNG-SBS2012-CA"

Log with --verbose
PS C:\Windows\system32> C:\Users\Public\Downloads\letsencrypt-win-simple.v1.9.8.4\letsencrypt.exe --test --verbose
[DBUG] Options: Options {BaseUri="https://acme-v01.api.letsencrypt.org/", Test=True, Verbose=True, Renew=False, ForceRenewal=False, Plugin=null, SiteId=null, ExcludeBindings=null, HideHttps=False, ManualHost=null,
ManualTargetIsIIS=False, Validation=null, ValidationMode="http-01", WebRoot=null, ValidationSiteId=null, Warmup=False, UserName=null, Password=null, AzureTenantId=null, AzureClientId=null, AzureSecret=null, AzureSub
scriptionId=null, AzureResourceGroupName=null, DnsCreateScript=null, DnsDeleteScript=null, KeepExisting=False, CentralSslStore=null, CertificateStore=null, Installation=[], InstallationSiteId=null, SSLPort=443, Scri
pt=null, ScriptParameters=null, CloseOnFinish=False, NoTaskScheduler=False, UseDefaultTaskUser=False, Cancel=False, AcceptTos=False, EmailAddress=null}
[DBUG] Test parameter set: https://acme-staging.api.letsencrypt.org/
[DBUG] Config folder: C:\ProgramData\letsencrypt-win-simple\httpsacme-staging.api.letsencrypt.org

[INFO] Let's Encrypt Windows Simple (LEWS)
[INFO] Software version 198.4.6605.15190 (RELEASE)
[INFO] IIS version 7.5
[INFO] ACME Server https://acme-staging.api.letsencrypt.org/
[INFO] Please report issues at https://github.com/Lone-Coder/letsencrypt-win-simple

[DBUG] Renewal period: 55

N: Create new certificate
M: Create new certificate with advanced options
L: List scheduled renewals
R: Renew scheduled
S: Renew specific
A: Renew all
V: Revoke certificate
C: Cancel scheduled renewal
X: Cancel all scheduled renewals
Q: Quit

Please choose from the menu: n

[INFO] Running in Simple mode

1: Single binding of an IIS site
2: SAN certificate for all bindings of an IIS site
3: SAN certificate for all bindings of multiple IIS sites
4: Manually input host names
C: Cancel

Which kind of certificate would you like to create?: 3

[DBUG] Scanning IIS sites
[INFO] No valid hosts found for SBS SharePoint.
[INFO] No valid hosts found for SharePoint Central Administration v4.
[INFO] No valid hosts found for SharePoint Web Services.
[INFO] No valid hosts found for WSUS-Verwaltung.

1312694709: Companyweb (1 bindings) [@C:\inetpub\wwwroot\wss\VirtualDirectories\Companyweb80]
1: Default Web Site (4 bindings) [@C:\inetpub\wwwroot]
7: Mangaard.de (1 bindings) [@C:\Web-Hosting\www.mangaard.de]
2: SBS Client Deployment Applications (2 bindings) [@C:\Program Files\Windows Small Business Server\Bin\webapp\ClientDeployment]
6: www.magneticpower.de (3 bindings) [@C:\Web-Hosting\www.magneticpower.de]
4: www.Mangaard.ch (3 bindings) [@C:\Web-Hosting\www.Mangaard.ch]
5: www.Mangaard-Physio.de (3 bindings) [@C:\Web-Hosting\www.Mangaard-Physio.de]

Enter a comma separated list of site IDs, or 'S' to run for all sites: 1,4,5,6,7

mangaard-informatik.de
www.mangaard-informatik.de
remote.mangaard-informatik.de
mail.mangaard-informatik.de
www.mangaard.ch
mangaard.ch
mail.mangaard.ch
www.mangaard-physio.de
mangaard-physio.de
mail.mangaard-physio.de
www.magneticpower.de
magneticpower.de
mail.magneticpower.de
mangaard.de

Press enter to include all listed hosts, or type a comma-separated lists of exclusions:

[INFO] Plugin IISSites generated target [IISSites] 1,4,5,6,7 [14 bindings - mangaard-informatik.de, ...]
[DBUG] Scanning IIS sites
[DBUG] Loading signer from C:\ProgramData\letsencrypt-win-simple\httpsacme-staging.api.letsencrypt.org\Signer
[DBUG] Getting AcmeServerDirectory
[DBUG] Send GET request to https://acme-staging.api.letsencrypt.org/directory
[DBUG] Loading registration from C:\ProgramData\letsencrypt-win-simple\httpsacme-staging.api.letsencrypt.org\Registration
[INFO] Authorize identifier: mangaard-informatik.de
[DBUG] Send POST request to https://acme-staging.api.letsencrypt.org/acme/new-authz
[INFO] Authorizing mangaard-informatik.de using http-01 validation (SelfHosting)
[DBUG] Writing web.config
[INFO] Answer should now be browsable at http://mangaard-informatik.de/.well-known/acme-challenge/h-rYk4Fg5TA8odc9MNitk8CtHfequNX0t4wC--JQN_Q