DevOps, Manage IIS Website task, netsh add sslcert, fails with error 1312

user_1073313 0
Viewed 1654

Trying to shift focus a bit based on initial feedback on the question.

In a DevOps release pipeline, using Manage IIS Website task, trying to add an https binding using a wildcard certificate. The certificate is in the local computer's certificate store (checked with mmc -> add snap-in "Certificates", select "Computer account" and "Local computer"), in the folder "Web Hosting\Certificates". I think this is where they end up when added from within IIS.

But when running the pipeline, it fails, with this entry in the log:

SSL Certificate add failed, Error: 1312
A specified logon session does not exist. It may already have been terminated.

The actual command line issued by the task is (anonymized by me):

"netsh" http add sslcert hostnameport=www.mydomain.se:443 certhash=*** appid={xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx} certstorename=MY

As indicated in a comment, the certstorename param should apparently be assigned a different value. Fine.

But the task properties page offers no setting for this parameter, so how do I change it? And what should I shange it to?

If it can't be changed in the task, where should I move the cert to enable the task to find it with the value certstorename=MY? I have tried to find and understand docs about this, but failed, probably due to lacking basic knowledge about certificate stores in general and the associated terminology.

iis-10 azure-pipelines-release-pipeline azure-devops netsh ssl-certificate
1 Answers

OK, so after a few more hours of digging I found the answers, as follows:

  1. In certmgr, the folders are really not folders but certificate stores. Not confusing at all.

  2. The subfolders "Certificates", "Certificate Revocation List" etc. are not really subfolders, but a way of sorting entries into their categories. Not confusing at all, either.

  3. The certificate store shown as "Personal" is denoted "MY" in script contexts. Not really confusing, but where is this really documented?

  4. Similarly, the certificate store shown as "Web Hosting" is probably denoted "WebHosting" without space in script contexts.

  5. IIS looks for certificates in both "WebHosting" and "MY", but as far as I understand "WebHosting" is preferred.

  6. The "Manage IIS Website" task for Azure DevOps release pipelines is hardcoded to only look in "MY". This has been reported as a problem here, but it was closed with a ref to the GitHub repo for all(?) Microsoft-authored tasks. I failed to find a corresponding issue there so I added one.

  7. The actual solution (workaround) is to copy or move the certificate from "WebHosting" to "MY", i.e. in certmgr drag it from "Web Hosting\Certificates" to "Personal", in which case a "subfolder" called "Certificates" magically appears. Note that the cert is not visible when "Web Hosting" is selected, you have to select the "subfolder" called "Certificates", but you should drag to "Personal" without adding a "Certificates" subfolder there first. Really very consistent, isn't it?

A good place to read about certs in Windows seems to be here, which would actually have been more helpful in a comment than a downvote and vote to close the question.

user_10733130
Related