Certificate Private Key Issue on One Windows Server

Question

Certificate Private Key Issue on One Windows Server

Shiv Poojan 20

I am facing an issue with a self-signed SSL certificate on one of my Windows Servers.

I have two Windows Servers running the same application over HTTPS on port 9901 Windows Certificate Console Warning

. The application was working correctly, but now the issue occurs on only one server, while the other server continues to work normally.

On the affected server, I receive the following error when trying to access the certificate's private key through the Certificates MMC console:

“No keys found for certificate!”

The certificate is still visible under Local Computer → Personal → Certificates.

I would like your assistance in identifying the exact root cause of this issue. Since the other server is working correctly, I would like to understand what changed on the affected server and why this problem occurred unexpectedly.

Could you please investigate whether this could be related to the private-key association, key-container permissions, Windows updates, certificate-store issues, or another underlying Windows Server problem?

My primary objective is to identify the root cause rather than simply apply a workaround or recreate the certificate.
Please guide me on how to proceed with the investigation.
Thank you for your support.
Best regards,

Shivpoojan

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Hi Shiv,

The "No keys found for certificate!" error in MMC indicates a broken link between the public certificate in the Certificate Store and its corresponding private key in the Windows Cryptographic Next Generation (CNG) or CryptoAPI Key Storage Provider (KSP/CSP) container on disk. This typically occurs when ACL permissions on the underlying MachineKeys folder (C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys or \Keys) are altered, when the key container file is deleted by antivirus or backup operations, or when the certificate association property is severed after a Windows Update or re-import without a private key.

To determine the exact root cause, open an administrative Command Prompt and run certutil -v -verifystore my "<Thumbprint_or_SerialNumber>" to inspect whether the key container file path, provider name, and unique key container name still exist on disk. If the command returns NCRYPT_E_NOT_FOUND or NTE_BAD_KEYSET, the key file itself was removed or moved; if it returns NTE_PERM, the key exists but permission to the service account or administrator was stripped. Additionally, running certutil -repairstore my "<Thumbprint>" can re-bind the orphan certificate to its matching private key if the underlying key container file remains intact.

Xuan Nhu.