Troubleshooting SSL Certificate Errors with Single Sign-On in Content Central

Problem

After replacing an SSL certificate for Content Central, Single Sign-On (SSO) users may receive the following error:

System.ArgumentException: Provided certificate is not valid for encryption/decryption.

This typically indicates insufficient private key permissions in the Windows certificate store, or the certificate does not have the correct key usage purposes.

Initial Troubleshooting Steps

1. Verify Certificate Key Usage

Open certlm.msc and navigate to Personal > Certificates.
Double-click the certificate to open its properties.
Select the Details tab and check the Key Usage (or Enhanced Key Usage) field.

✅ Required: Must include Digital Signature AND Key Encipherment, or have no Key Usage field (unrestricted).
❌ Problem: If Key Usage exists but lacks Key Encipherment, the certificate cannot be used for encryption

If no Key Usage field is present, the certificate is unrestricted and this is not the issue.

2. Check Private Key Permissions

In certlm.msc, right-click the certificate and select All Tasks > Manage Private Keys.
Verify the IIS AppPool identity (e.g., IIS AppPool\ContentCentral) has at least Read permission.
If missing, add the AppPool identity with Read permission.

Advanced Diagnosis: Provider Issue

If both checks pass but the error persists, verify the cryptographic provider.

Run this PowerShell command: certutil -store My "<certificate name>"

Problem indicator: Provider = Microsoft Software Key Storage Provider (or contains CNG).
Required: Provider = Microsoft RSA SChannel Cryptographic Provider.

Resolution for Provider Issue

If the Certificate is Exportable

Export the certificate with its private key: certutil -exportPFX My "<certificate name>" c:\temp\cert.pfx
Delete the existing certificate from the store.
Re-import with the legacy provider: certutil -importPFX -csp "Microsoft RSA SChannel Cryptographic Provider" c:\temp\cert.pfx
Grant the IIS AppPool identity access to the private key (as described above).

If the Certificate is NOT Exportable

Generate a new CSR and mark it as exportable.
Obtain a new certificate from the Certificate Authority (CA).
Import with the legacy provider (see step 3 above).
Update IIS bindings to use the new certificate.
Update the SSO IdP configuration with the new certificate.

Optional Workaround (Signing Only)

If the certificate lacks Key Encipherment and cannot be replaced, you may configure Sustainsys to use the certificate for signing only.

Edit web.sustainsys.saml2.config:

<add storeName="My" storeLocation="LocalMachine"

findValue="<certificate name>"

x509FindType="FindBySubjectName"

use="Signing" />

This limits the certificate to signing operations only. If encryption is required by the IdP, it may not be supported. Use this workaround only if encryption is not required.

Prevention

When requesting new certificates for SSO:

Use the RSA algorithm (not ECC/ECDSA).
Ensure Digital Signature and Key Encipherment usage (or unrestricted).
Mark the certificate as exportable.
Use the Microsoft RSA SChannel Cryptographic Provider (legacy CSP), not CNG.

Numbered steps and bolded key terms for clarity.

If the issue persists after completing these steps, gather the following before contacting Ademero Support:

A screenshot of the certificate properties (Key Usage and Provider).
A screenshot of the certificate private key permissions.
The output of certutil -store My "<certificate name>".

This will help the support team diagnose the problem more quickly.