SSL Certificate add failed when binding to port

Question

I created a WebService using WCF. I'm doing self hosting and I want to enable HTTPS. From my understanding for this to happen, I need to create a certificate and bind to the port that I want to use.

Here are the steps that I've done to handle this:

1. Created a Certificate on my local machine to act as the Root Certificate Authority
   • makecert -n "CN=My Root Certificate Authority" -r -sv RootCATest.pvk RootCATest.cer
2. Opened MMC.exe and imported the saved .cer file into the "Trusted Root Certificate\Certificates\ folder
   • makecert -sk MyKeyName -iv RootCATest.pvk -n "CN=MyMachineName" -ic RootCATest.cer -sr localmachine -ss my -sky exchange -pe MyMachineName.cer

3. Created a temporary service certificate from the signed Root Certificate Authority

   • makecert -sk MyKeyName -iv RootCATest.pvk -n "CN=MyMachineName" -ic RootCATest.cer -sr localmachine -ss my -sky exchange -pe MyMachineName.cer

4. Tried to Bind the Certificate to the Port number (443 in this case)

   • netsh http add sslcert ipport=0.0.0.0:443 certhash=2c5ba85bcbca412a74fece02878a44b285c63981 appid={646937c0-1042-4e81-a3b6-47d678d68ba9}

The result from step 4 is the following error:

SSL Certificate add failed, Error 1312

A specified logon session does not exist. It may already have been terminated.

Does anyone have a clue why I might be getting this error?

Answer 1

In my case, i have missing the certificate private key.

Answer 2

I've being working on this for hours, and basically read through what @DoomerDGR8 said above, but my fix was a lot more simple. I ran

 C:\Windows\system32> certutil -store TRUSTEDPUBLISHER

This listed several certificates I have installed, I then ran repair store on the certificate that I was having a problem installing with netsh.

C:\Windows\system32> certutil -repairstore TRUSTEDPUBLISHER 6

The number 6 at the end represents the index of your certificate, found at in the store, hope this helps

Answer 3

There are multiple ways of receiving this error (see above for other answers).

Another way to receive this specific error is to attempt to bind a certificate to a port when the certificate is not in the appropriate store.

Verify that the certificate is stored in the localMachine Root store (you can use certutil or certmgr.exe from command line to dump it correctly).

updated grammar :)

Answer 4

This might seem obvious; however, I think it can save someone some time of head scratching. I had imported a file with .cer extension under my Personal certificates folder (for the Personal Computer account). After a while, I realized that I needed to import the file with the *.pfx extension instead. Fixed that and voilà! Problem solved!