{Quick Tip} Certificate disappearing in IIS of CRM server even after successful import.

Before I proceed with the post. let me clear this out. There is nothing special about IIS server where CRM is installed. It applies to all IIS servers. However being a devotee of Dynamics for quite sometime now, can’t write any post without tagging CRM to it. Smile

So here I was working for a client with on-premise 2016 version. And their certificate is about to expire. They needed to generate a CSR for a SAN Certificate as wildcard certificates are not allowed by most of company policies.

So they used Open SSL to generate the CSR. For reader’s who might be interested in knowing how to generate SAN Certificate using Open SSL, https://geekflare.com/san-ssl-certificate/ provides a good example. And they got the certificate back from the Network team.

Now the D-day. They imported the certificate in Personal store and  also imported the certificate in IIS using ‘Complete Certificate Request’ option. All set and good.

But the moment they try to bind the certificate to dynamics CRM site, they could not find the certificate. Repeated this process. However the same behavior every time.

A bit of research and this is what comes up – “Certificate without private Key Information in it, cannot be binded to a IIS website.”

But how to do it?

When you generate a CSR request using Open SSL, the private key is output to a file. Usually the name is “Private.Key”, unless you specified something else.

So you have the private key and the certificate separately. But how to bind the certificate with the Private key?

Follow the below steps

  • Copy the Private Key file and the certificate to the Open SSL bin folder. Usually is it C:\OpenSSL-Win64 for 64 bit machines and C:\OpenSSL-Win32 for 32 bit machines
  • Open command prompt as administrator and navigate to the bin folder in the command prompt.
  • Run the below command

openssl pkcs12 -export -out certificate.pfx –inkey private.key -in certificate.crt –certfile

Here Certificate.pfx in the output certificate with the private key information and certificate.crt is the certificate you received from Network team.

Once the command completed successfully, you should be able to view Certificate.pfx in the bin folder.

Now all set and done. You will now just need to import this certificate to the IIS. But remember to use the “Import” option in the certificate window.



A rather off topic but hope it makes an interesting read.


Debajit Dutta

(Business Solutions MVP)

For corportate training/ consulting, please drop a note to info@xrmforyou.com or visit our website – www.xrmforyou.com

About Debajit
I am a Dynamics CRM Most Valuable Professional (MVP) with 12 years of experience in Microsoft .NET Technologies and 9 years of dedicated experience in Microsoft Dynamics CRM. I have worked with companies like Microsoft, SanDisk, PwC, TMF Group and have extensive experience of implementing complex CRM solutions from both offshore and client side. Currently the face of XrmForYou.com with significant experience in delivering corporate training on Dynamics CRM and have already delivered multiple projects to client through XrmForYou.com Author of multiple tools on codeplex including the 'Role Based Views' and 'CRM-Sharepoint Metadata manager & Attachment Extractor' which are available for commercial use under XrmForYou.com For consulting/ training, drop me a note at info@xrmforyou.com or visit our website www.xrmforyou.com

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: