WindowsCryptographicException: Access denied.

[nirv117 1]

I got an SSL cert from LetsEncrypt (installed with Certify the web into IIS)

I exported the certificate to a PFX file and set a password.  I pointed my Emby server (4.5.2.0) to the certificate and supplied the password, external domain, etc.  When I restart emby it is failing to load the certificate and enable https.  the logs show

Error App: Error loading cert from C:\EmbySSL\emby.pfx

*** Error Report ***
    Version: 4.5.2.0
    Command line: C:\Users\*******\AppData\Roaming\Emby-Server\system\EmbyServer.dll -noautorunwebapp
    Operating system: Microsoft Windows 10.0.19041
    Framework: .NET Core 3.1.8
    OS/Process: x64/x64
    Runtime: C:/Users/*******/AppData/Roaming/Emby-Server/system/System.Private.CoreLib.dll
    Processor count: 4
    Data path: C:\Users\*******\AppData\Roaming\Emby-Server\programdata
    Application path: C:\Users\*******\AppData\Roaming\Emby-Server\system
Internal.Cryptography.CryptoThrowHelper+WindowsCryptographicException: Internal.Cryptography.CryptoThrowHelper+WindowsCryptographicException: Access denied.
       at Internal.Cryptography.Pal.CertificatePal.FilterPFXStore(Byte[] rawData, SafePasswordHandle password, PfxCertStoreFlags pfxCertStoreFlags)
       at Internal.Cryptography.Pal.CertificatePal.FromBlobOrFile(Byte[] rawData, String fileName, SafePasswordHandle password, X509KeyStorageFlags keyStorageFlags)
       at System.Security.Cryptography.X509Certificates.X509Certificate..ctor(String fileName, String password, X509KeyStorageFlags keyStorageFlags)
       at System.Security.Cryptography.X509Certificates.X509Certificate2..ctor(String fileName, String password)
       at Emby.Server.Implementations.ApplicationHost.GetCertificate(CertificateInfo info)
    Source: System.Security.Cryptography.X509Certificates
    TargetSite: Internal.Cryptography.Pal.Native.SafeCertContextHandle FilterPFXStore(Byte[], Microsoft.Win32.SafeHandles.SafePasswordHandle, Internal.Cryptography.Pal.Native.PfxCertStoreFlags)

 

I have tried adjusting file permissions on the .pfx file, I have verified the password.  I have exported the SSL cert from iis, and also from the certificates console, I have verified the domain name is correct. I have tried different encryption methods for the export, and now I am stumped as to what I am missing.

[Abobader 2945]

Hello, nirv117,

Thank you for reaching out us. Please wait for someone from staff support to reply to you.

It's recommended to provide more info, as it explain in this thread:

How to Report a Problem

Thank you.

Emby Team

[nirv117 1]

I went ahead an used another method to generate my SSL certificate (SSL for Free), and Emby likes that certificate.  I am up and working with SSL now.

[Luke 37069]

Thanks for the feedback !