One problem met when granting permission of "NETWORK SERVICE" to the a certificate of "Online Response Signing" template using "winHttpCertCfg" tool
Hi, Currently, I am using commands to write scripts to do some Automation testing. I met such a problem defined as below: I requested a certificate under the template of "Online Response Signing"in Windows Server 2008. Then I needed to grant the permission of "NETWORK SERVICE" to the private key of it. When I manuallydid this(right click on the certificate,put the pointer on"All Task" and choose the "Manage Private Key..." item and then add the "NETWORK SERVICE" within the "Permissions for XXXX private key" dialog), the operationwas OK. But when I use the command "cmd.exe /c winhttpcertcfg.exe -g -c LOCAL_MACHINE\My -s "CertificateName" -a "NETWORK SERVICE" " to grant the permission of "NETWORK SERVICE" to the private key of the certificate, thereis such error as below:Microsoft (R) WinHTTP Certificate Configuration ToolCopyright (C) Microsoft Corporation 2001. Matching certificate:CN=SUT01.contoso.com Error: Access was not successfully obtained for the private key. This can only be done by the user who installed the certificate. Totrace the causefor the problem more correctly, Icreated a certificate under the templateof "Computer" and then use thesame command, it succeeded. The success information of the operation is as below: Microsoft (R) WinHTTP Certificate Configuration ToolCopyright (C) Microsoft Corporation 2001. Matching certificate:CN=SUT01.contoso.com Private key access has already been granted for account: NT AUTHORITY\NETWORK SERVICE BTW,I usedthe same account toinvoke the winhttpCertCfg command as theone that createdit. Does anyone know what's the reason for this problem. Is it required to set some properties within the"Online Response Signing" certificate template or is there any other methodcancomplete my operation through commands. If there is, please tell and I will be extremely grateful to you!ThanksEdward
November 18th, 2008 9:20am

the 'run as' command could probably be a solution for this. You've granted permission by copying the certificate and using a local account. Best practice would be to use an account privileged to change that kind of information on the network. Information is the most valuable commodity I know off.
Free Windows Admin Tool Kit Click here and download it now
December 18th, 2008 6:14am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics