My client send me three files from Go-Daddy (86f8ac00fcd77994.crt, 86f8ac00fcd77994.pem and gd_bundle-g2-g1.crt). I need create a jks keystore from this files. Is it possible? Thanks!
PD: Sorry for my english!
Yes but you don't want to.
Java uses keystore files like JKS, and KeyStore objects in memory, to store two (or three) different kinds of information but many people imprecisely call both of them certificates and don't understand the huge and critical difference. Specifically (and changing the order from the javadoc):
a TrustedCertificate entry contains "[one] certificate ... belonging to another party. .... This type of entry can be used to authenticate other parties."
a PrivateKey entry contains a privatekey PLUS a certificate CHAIN "used by a given entity for self-authentication".
for completeness, some keystores can contain a SecretKey entry, but JKS cannot, and even with those that can this capability is rarely used.
The files you have are all certificates (one in the hex-named files, several in the bundle file), not privatekeys. You can import each of them into a TrustedCert entry, but TrustedCert entries are only used to validate the other end of a communication -- i.e. when you connect to a server, the TrustedCert entries are used to validate that server's cert, and if you accept connection from a client and request client auth (which is not the default and is rare), the TrustedCert entries are used to validate that client's cert. But since this cert was issued by GoDaddy, if it is used correctly (with its chain) by a server or client you communicate with, you don't need any TrustedCert entries because it validates against a root already in Java's default truststore.
If you wanted to use this cert to authenticate 'yourself' (that is, your system) -- for example if you wanted to run a TLS server (possibly but not necessarily an HTTPS web server) identified by this cert -- you would need a PrivateKey entry, not any TrustedCert entries, and you can't create a PrivateKey entry because you don't have the privatekey. The person who obtained this certificate from GoDaddy does have the privatekey, because the certificate request process requires it, so they could e.g. run a server, but they didn't give it to you so you can't.
Thus the answer to the question you asked -- can you put these certs in a JKS -- is yes, you can. But it's a complete waste of time, because the resulting JKS cannot be used for anything and is worthless.
We have an Microsoft Active Directory Domain with a large pool of domain controllers (DC) that are are setup with LDAP. These are all setup with LDAPS and uses Certificate Services via a template to setup a certificate with the domain name (i.e. test.corp) in the Subject Alternate Name (SAN) for the LDAPS server to serve.
Since these are DC's, DNS is setup in a pool for each these systems to respond to requests to test.corp in a round robin fashion.
Each of these DC's have multiple templates and multiple certificates in the Local Computer\Personal Certificate Store.
Upon testing, using a nodejs module, ldapjs when making a LDAPS request using the domain name, test.corp we notice that a handful of servers fail with the following message:
Error [ERR_TLS_CERT_ALTNAME_INVALID]: Hostname/IP does not match
certificate's altnames: Host: test.corp. is not in the cert's
altnames: othername:, DNS:.test.corp
As we investigated we found that these handful of LDAPS servers are serving the incorrect certificate. We determined this by using the following command
openssl s_client -connect .test.corp:636
If you take the certificate section of the output and put it in a file and use a tool such as the Certificate manager or certutil to read the file, you can see the certificate is not the correct one. (It does not have the domain "test.corp" SAN). We also verified this by comparing the Serial Numbers
As we investigated, since we have DC's that have multiple certificates in the Local Computer\Personal Certificate store, we came across the following article:
https://social.technet.microsoft.com/wiki/contents/articles/2980.ldap-over-ssl-ldaps-certificate.aspx
It suggests putting the certificate from the local computer\Personal certificate store to the Active Directory Domain Service\Personal store. We followed the steps outlined but we found the same results.
Upon further investigation, it was suggested to use a tool called ldp or adsiedit. We then proceeded to use these tools and spoofed the local machine's host file we were doing the test from, to point the domain (test.corp) to the ip's of one of the DC's that are giving us trouble. After a restart to clear any cache we tested the "ldp" and "adsiedit" tools to connect to test.corp. These systems did not report any errors.
We found this odd, we then ran the openssl command to see what certificate it was serving from this same system and we found it was still serving the incorrect certificate.
Upon further research, it appears that the "ldp" upon selecting the SSL checkbox and "adsiedit" tools were not compliant with RFC6125, specifically B.3
https://www.rfc-editor.org/rfc/rfc6125#appendix-B.3
, which basically states the identity of the certificate must match the identity of the request otherwise the handshake would fail. This identity verification is done by using the certificate common name (CN) or the SAN.
Based on this appears the tools "ldp" and "adsiedit" are not conforming to the RFC6125 standard.
All this to say, we need to first fix the handful of domain controllers that are serving the correct certificate. We are open to suggestions since we have been working on this problem for the past few months. Second, is there a way to get the MS tools in question to work to the RFC6125 standard?
This has been moved to:
https://serverfault.com/questions/939515/ldaps-microsoft-active-directory-multiple-certificates-rfc6125
RFC6125 specifically states that it does not supersede existing RFCs. LDAP cert handling is defined in RFC4513. Outside of that, RFC6125 has significant flaws. See also https://bugzilla.redhat.com/show_bug.cgi?id=1740070#c26
LDP will supposedly validate the SSL against the client store if you toggle the ssl checkbox on the connection screen.
That said, I'm not surprised that neither it nor ADSI edit enforce that part of the standard given they are often used to configure or repair broken configurations. Out of the box and without Certificate Services they use self signed certs on LDAPS. I would wager 80% of DCs never get a proper certificate for LDAP. If they enforced it most wouldn't be able to connect. A better design decision would have been to toggle off the validation.
I use a similar openssl command to verify my own systems. I think it's superior to LDP even if LDP were to validate the certificate. To save you some effort, I would suggest using this variant of the openssl command:
echo | openssl s_client -connect .test.corp:636 2>/dev/null | openssl x509 -noout -dates -issuer -subject -text
That should save you having to output to a file and having to read it with other tools.
I've found LDAPS on AD to be a huge pain for the exact reasons you describe. It just seems to pick up the first valid cert it can find. If you've already added it to the AD DS personal store, I'm not sure where else to suggest you go other than removing some of tother certs from the DCs computer store.
I created a WebService using WCF. I'm doing self hosting and I want to enable HTTPS. From my understanding for this to happen, I need to create a certificate and bind to the port that I want to use.
Here are the steps that I've done to handle this:
Created a Certificate on my local machine to act as the Root Certificate Authority
makecert -n "CN=My Root Certificate Authority" -r -sv RootCATest.pvk RootCATest.cer
Opened MMC.exe and imported the saved .cer file into the "Trusted Root Certificate\Certificates\ folder
makecert -sk MyKeyName -iv RootCATest.pvk -n "CN=MyMachineName" -ic RootCATest.cer -sr localmachine -ss my -sky exchange -pe MyMachineName.cer
Created a temporary service certificate from the signed Root Certificate Authority
makecert -sk MyKeyName -iv RootCATest.pvk -n "CN=MyMachineName" -ic RootCATest.cer -sr localmachine -ss my -sky exchange -pe MyMachineName.cer
Tried to Bind the Certificate to the Port number (443 in this case)
netsh http add sslcert ipport=0.0.0.0:443 certhash=2c5ba85bcbca412a74fece02878a44b285c63981 appid={646937c0-1042-4e81-a3b6-47d678d68ba9}
The result from step 4 is the following error:
SSL Certificate add failed, Error 1312
A specified logon session does not exist. It may already have been terminated.
Does anyone have a clue why I might be getting this error?
I had the same error. The first time it occurred, as Micheal said, I had to move the certificate under Certificates(Local Computer) -->Personal -->Certificate folder. I had the same error when I imported the same certificate on another machine. The reason was that I was using certmgr.msc to import the certificate. . The window opened thus shows “Certificates – Current User”. Certificates imported using this window cause netsh to fail with the 1312 error. Make sure to use certificate snap-in in MMC to import certificates. The certificate snap-in from MMC shows “Certificates (Local Computer)”. This lets the netsh execution sail through.
SSL Certificate add failed, Error 1312
A specified logon session does not exist. It may already have been terminated.
I used to have the exact same problem and spent a couple days trying to figure out what the reason was.
To make the long story short: the problem is that you have installed the certificate on the winrm server that does not have PRIVATE KEY.
I have checked this several times. You have to delete your certificate and rebuild it by using makecert for instance, as it is described perfectly here: http://blogs.technet.com/b/jhoward/archive/2005/02/02/365323.aspx
You can easily check if your certificate has private a key as so: mmc - certificates - local machine - personal. Look at the icon of the certificate - it MUST have key sign on the icon.
I have bought an official Thawte certificate to secure a self hosted (console application) web service over a specific port on our internet server.
I then have received the Thawte certificate and installed it with mmc on our Internet server (the certificate then was viewable under „Trusted Root Certification Authorities“ (with the key icon on the image, what shows that the certificate contains a private key what is mandatory to be able to bind it to a port b.t.w.) .
Next step was to enable the <port> for https:
netsh http add urlacl url=https://+:<port>/ user=everyone
(what was no problem)
Next step was to enable the port () for https:
netsh http add sslcert ipport=0.0.0.0:<port> certhash=<thumbprint to certificate> appid={<guid to application>}
This has failed with the error message:
SSL Certificate add failed, Error: 1312 A specified logon session does not exists. It may be already have been terminated.
I then have searched the Internet and tried various suggested workaround’s (without success).
The solution for my case was to add certstorename=Root to the netsh command:
netsh http add sslcert ipport=0.0.0.0:<port *1)> certstorename=Root certhash=<thumbprint to certificate *2)> appid={<guid to application *3)>}
Notes:
If no certstorename is applied to net netsh command, netsh takes the default, what is MY (what targets the certificate store: “Personal” where self signed certificates are stored normally).
Root targets the certificate store: „Trusted Root Certification Authorities“
*1): The port, you want to use the connection
*2): You can extract the thumbprint to the certificate, if you open the certificate (on a windows system, just doubleclick the certificate in explorer) - select tab “Details” and click on “Thumbprint”. The “thumbprint” then is showed and can be copied. Copy the Thumbprint and remove all spaces...
*3): As appid you can take any ID in the form {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx} as the APPID is only informative.
With the command “netsh http show sslcert” you can query the bound certificates on the whole machine and the will see informative, which appid is bound to which certificate (not really helpful in practice b.t.w.)
In my case, I have took the (from VS generated) GUID to my web service application
I had been dealing with this issue and I'm using a self-hosted WCF service. I just made the breakthrough:
I had a certificate in the personnel folder for the Machine store. It expired and my manager issued a new one. The new one failed for me with this error. I tried a lot of stuff from Google but in the end, resolved the issue using a completely different solution.
I installed both certificates- the expired one and the newer one. Then I used this command to get a list of them:
certutil -store My
I get this output (info is fake and other certificate are not listed):
================ Certificate 1 ================
Serial Number: 6d
Issuer: E=operations#voicetrust.com, CN=VoiceTrust Server CA, OU=VoiceTrust Oper
ations, O=VoiceTrust
NotBefore: 03-Jan-2013 3:33 PM
NotAfter: 03-Mar-2013 3:33 PM
Subject: E=hgulzar#voicetrust.com, CN=hornet.voicetrust.com, OU=Software Develop
ment, O=VoiceTrust eServices MENA FZ LLC, L=Dubai, C=AE
Non-root Certificate
Cert Hash(sha1): 98 5f a0 d3 11 6a 4b 64 3b db 0a a4 11 66 fc 08 28 74 7e 53
Key Container = {E5BC0912-7808-4B89-B457-31946DE5990E}
Unique container name: dfedfcc149408fb990a3bacd6d31126b_3277b2c9-9894-46d0-9b6
4-30f0d6589239
Provider = Microsoft Enhanced Cryptographic Provider v1.0
Private key is NOT exportable
Encryption test passed
================ Certificate 2 ================
Serial Number: 6d
Issuer: E=operations#voicetrust.com, CN=VoiceTrust Server CA, OU=VoiceTrust Oper
ations, O=VoiceTrust
NotBefore: 03-Nov-2013 3:33 PM
NotAfter: 03-Dec-2013 3:33 PM
Subject: E=hgulzar#voicetrust.com, CN=hornet.voicetrust.com, OU=Software Develop
ment, O=VoiceTrust eServices MENA FZ LLC, L=Dubai, C=AE
Non-root Certificate
Cert Hash(sha1): 30 5f a0 d3 11 6a 4b 64 3b db 0a a4 11 66 fc 08 28 74 7e 53
Key Container = {E5BC0912-7808-4B89-B457-31946DE5960E}
*Unique container name:* 55edfcc149408fb990a3bacd6d31126b_3277b2c9-9894-46d0-9b6
4-30f0d6589239
Provider = Microsoft Enhanced Cryptographic Provider v1.0
Private key is NOT exportable
Encryption test passed
Now, everything seems OK but certificate 1 is expired and works if I try to bind it to a port whereas Certificate 2 fails with Error 1312.
The key difference that baffled me was the Unique container name property. It should be representing a physical key file on the hard drive in the %ProgramData%\Microsoft\Crypto\RSA\MachineKeys\
For Certificate 1, the file was there but for Certificate 2, there was no such file. After searching I found the file against Certificate 2 in the sub folder of %AppData%\Microsoft\Crypto\ folder. That's user specific keys not Machine level keys. It's amazing that the certificate is being imported into Computer store yet it always keeps the container key of User's store.
I deleted the '55edfcc149408fb990a3bacd6d31126b_3277b2c9-9894-46d0-9b64-30f0d6589239' file under the AppData folder and ran the repair command for my certificate 2 on the store:
certutil -repairstore My 2
This time, the Unique container name was reflecting a file in the proper folder under '%ProgramData%\Microsoft\Crypto\' and everything started working.
Hope this is helpful to someone.
I've been fighting error 1312 all day, what fixed it for me was to import the certificate in mmc as a .p12 file instead of a .crt. If you are creating it with OpenSSL then once you have created the .crt, do:
pkcs12 -export -in server.crt -inkey server.key -name “Your Name” -out server.p12
As described. When you go to import it in mmc it will be a called "Personal Information Exchange" file (and apparently a .pfx file would also work).
I'm new to writing servers and dealing with SSL and I have no idea why this works, but I hope it helps.
The problem was in step 4. I was using the Thumbprint from the Root Certificate for the value in certhash. To solve this I had to go back to the MMC and refresh the Certificates(Local Computer) -->Personal -->Certificate folder. Then use the Thumbprint from the certificate that is "Issued By" the Root Certificate Authority.
I my case the problem was that the CER file hasn't private key attached.
I've attached PK using those OpenSSL commands:
openssl x509 -in server.der -inform DER -out server.pem -outform PEM
openssl pkcs12 -export -in server.pem -inkey serverkey.pem -out server.p12
Works for CER/DER files.
I had the same problem and solved importing the certificate using this command:
c:> certutil -importPFX certname.pfx
Now the certificate appear using this command:
c:> certutil -store my
before this command the certificate doesn't appear
This might seem obvious; however, I think it can save someone some time of head scratching. I had imported a file with .cer extension under my Personal certificates folder (for the Personal Computer account). After a while, I realized that I needed to import the file with the *.pfx extension instead. Fixed that and voilà! Problem solved!
There are multiple ways of receiving this error (see above for other answers).
Another way to receive this specific error is to attempt to bind a certificate to a port when the certificate is not in the appropriate store.
Verify that the certificate is stored in the localMachine Root store (you can use certutil or certmgr.exe from command line to dump it correctly).
updated grammar :)
If anyone else runs into this problem and the answers in here do not clearly answer it, the underlying core problem is the private key needs to be imported. If you do not mark the certificate as exportable when you import it, the private key is not imported and you cannot bind it. If you delete it and re-import it and mark it as exportable, then it will work.
It also needs to be the local machine store as others have pointed out.
If:
you didn't have IIS on your machine (working with self-hosted WCF let's say), and
you made your cert request on another machine using IIS Manager (because you didn't understand that the private key comes from ciphers embedded in the cert request - and later the issued .pb7)
then:
just go install the .pb7 on the IIS machine you used to make the cert request (local machine/personal/certificates - using mmc);
export the cert from that machine, including its private key (assign password); and
install it using mmc on the WCF server (local machine/personal/certificates - using mmc).
Then, netsh will let you bind to port 443. No more 1312 errors.
Just to throw yet another answer into the ring, this is the problem I had:
Although I imported my certificate into the (Local Computer)\... certificate store, I had imported it into the Trusted Root Certification Authorities section. I needed to import it into the Personal section, otherwise this error occurred.
In my case, i have missing the certificate private key.
IF you imported the certificate using .NET, specific import flags must be used:
/// <summary>
/// Imports X.509 certificate from file to certificate store.
/// </summary>
/// <param name="fileName">Certificate file.</param>
/// <param name="password">Password.</param>
/// <param name="storeName">Store name.</param>
/// <param name="storeLocation">Store location.</param>
public static void ImportCertificate(string fileName, string password, StoreName storeName, StoreLocation storeLocation) {
var keyStorageFlags =
X509KeyStorageFlags.PersistKeySet
| (storeLocation == StoreLocation.LocalMachine ? X509KeyStorageFlags.MachineKeySet : X509KeyStorageFlags.UserKeySet);
var cert = new X509Certificate2(fileName, password, keyStorageFlags);
var store = new X509Store(storeName, storeLocation);
store.Open(OpenFlags.MaxAllowed);
store.Add(cert);
store.Close();
}
The ImportCertificate method is a part of the Woof.Security package created by me.
https://github.com/HTD/Woof.Security
https://www.nuget.org/packages/Woof.Security/
This is my summary of all the fixes in this thread and how it worked for me:
Find "Windows PowerShell", right-click on the icon, and choose "run as administrator".
Find "Wordpad", right-click on the icon, and choose "run as administrator". (this is so you can copy and paste between PowerShell and Wordpad.)
In PowerShell run "netsh HTTP show sslcert".
From the info that shows, copy the "Certificate Hash", "Application Id", and "Certificate Store Name". (You'll need all these in a moment.)
(If you need to) locate your *.cer or *.crt file and export it as a *.pfx file.
In Powershell, navigate to the folder of your *.pfx file.
Now run "certutil -importPFX .pfx".
Then run "certutil -store my" to show the installed certs.
Now using the info from step #4 run this "netsh http add sslcert ipport=0.0.0.0:8000 certstorename= certhash= appid='' (I had to put them in this order, with my cert store name, and single quotes around the app id.)
Check that the SSL cert was added by running "netsh HTTP show sslcert" again.
I had exact same problem eventhough my .pfx file had private key. Adding of certificate with MMC console was successful, but adding programatically using .Net X509Store.Add(X509Certificate2) method failed every time with error 1312. Certificate even had a key sign on the icon.
After several days finaly decided to make new certificate using makecert.exe as suggested in posts here. After that everything was fine. Key appeared in %ProgramData%\Microsoft\Crypto\RSA\MachineKeys. For some reason my earlier pfx file was not compatible.
In my experience, as long as your key in not appearing in %ProgramData%\Microsoft\Crypto\RSA\MachineKeys\, binding with 'netsh http add sslcert ....' will fail.
The certstorename argument should be the string value of the StoreName enumeration from the .net framework namespace System.Security.Cryptography.X509Certificates.
I've being working on this for hours, and basically read through what #DoomerDGR8 said above, but my fix was a lot more simple. I ran
C:\Windows\system32> certutil -store TRUSTEDPUBLISHER
This listed several certificates I have installed, I then ran repair store on the certificate that I was having a problem installing with netsh.
C:\Windows\system32> certutil -repairstore TRUSTEDPUBLISHER 6
The number 6 at the end represents the index of your certificate, found at in the store, hope this helps
In my case while creating the certificate I chose a different name than My for my Cert Store name. The default name is MY. So if yours is different append certstorename=Your provided store name to the command.
I had the same error when creating self signed certificate with OpenSSL(BouncyCastle) I resolved it with help from this post:
Cannot export generated certificate with private key to byte array in .net 4.0/4.5
I had to add:
RsaPrivateKeyStructure rsa = RsaPrivateKeyStructure.GetInstance(seq); //new RsaPrivateKeyStructure(seq);
RsaPrivateCrtKeyParameters rsaparams = new RsaPrivateCrtKeyParameters(
rsa.Modulus, rsa.PublicExponent, rsa.PrivateExponent, rsa.Prime1, rsa.Prime2, rsa.Exponent1, rsa.Exponent2, rsa.Coefficient);
var rsaPriv = DotNetUtilities.ToRSA(rsaparams);
var cspParams = new CspParameters
{
KeyContainerName = Guid.NewGuid().ToString(),
KeyNumber = (int)KeyNumber.Exchange,
Flags = CspProviderFlags.UseMachineKeyStore
};
var rsaPrivate = new RSACryptoServiceProvider(cspParams);**
// Import private key from BouncyCastle's rsa
rsaPrivate.ImportParameters(rsaPriv.ExportParameters(true));
// Set private key on our X509Certificate2
x509.PrivateKey = rsaPrivate;
So to add (yet) fix/situation.
I had C# code that used BouncyCastle to create self-signed certificates.
<packages>
<package id="BouncyCastle" version="1.8.1" targetFramework="net45" />
So my code created the certificates AND placed them in the correct locations in the Cert-Store.
Using the hints here, my install of On Premise Service Bus 1.1 was failing...and that led me here.
I ended up DELETING both certificates my BouncyCastle code had created (from the cert store) and reimporting them (with private keys)....and it all worked.
I imported FIRST to the
Certificates (Local Computer) / Personal / Certificates
then I copied pasted (in the mmc) to any other places (stores) I needed them.
My "before" and "after" looked exactly the same from my eyes in MMC, BUT it fixed the issue. Go figure.
I just had yet another error. I renewed an expired cert for our WorkFolders service from our CA using the same private key. Then I always got Error 1312. Even if Certificate Management shows I have a private key.
I could only solve the problem by re-issuing a new certificate (without the renew option). Then it worked on the first try.
Maybe this will help someone who also tried the renew option.
For me the problem was solved by ensuring that the certificate hash I was using in my command line, corresponded to the certificate installed on my server:
netsh http add sslcert ipport=0.0.0.0:8081 certhash=1061a577f0cc1c428186000dc84f02a7111ca1b2 appid={GUID}
On my side, the files provided were a P7B file together with a bunch of cert files. After getting stuck, I asked for my colleague's help and he gave me an idea to import the certificates together with the private key via a PFX.
This article gave me the instruction to convert the P7B file into PFX. To summarize, you simply have to do the following:
Use openssl to convert the P7B file into PEM first
Convert the PEM file into PFX
You can now import the PFX file. Better to read the article I stated above because it has significant information to note.
Finally I solved it. The problem is the certificate file. I tested it other mac and failed it. Here is my solution.
Remove .cer file
Re-create certificate file.
If failed, also re-create CSR file.
Thank you.
Looks like this is a generic error. My fix is unlike all the rest.
Using Azure Devops for a deployment, the step IIS Web App Manage has the cert hash buried/hidden in IIS Bindings (which the only way to see the cert hash is to edit that specific piece), so you have to update the hash so it matches on the server you're deploying to. And voila, you're set.
I was getting this error when trying to deploy from an Azure Devops pipeline to a Windows Server box running IIS. The pipeline should deploy the site to IIS and then create an https binding where the existing certificate in the computer cert store was referenced by it's thumbprint. In the pipeline the thumbprint was meant to be drawn from variable group - however the correct variable group wasn't linked to the pipeline (and the variable name was wrong) - so it got nothing.
Basically the wrong thumbprint was being used to identify the cert, I suspect it wasn't giving a standard "can't find the SSL cert" message because I was attempting to find the cert with a null.
I need to secure a WCF service that uses netTcpBinding and connects directly with a Windows Forms based application. I only need it to be secured at the transport layer.
I'm pretty sure that I have it working locally, i.e. I can run the service locally, and connect to it with the client.
When I try to setup the service so that it is running on a server as opposed to my local machine, I'm having certificate issues. The error log says that the certificate must have a private key that is capable of key exchange and that the process must have access rights for the private key.
I'm using a development certificate created using makecert.
makecert -n "CN=MY COMPANY DEBUG" -pe -sky exchange Debug.cer
I must admit that I'm very new to using certificates. Does anyone have any pointers on how I can fix this, or a better way to use a certificate to add transport security to a WCF service using netTcpBinding?
Thanks.
Try this:
makecert -n "CN=MY COMPANY DEBUG" -pe -sky exchange Debug.cer -sv Debug.pvk
pvk2pfx -pvk Debug.pvk -spc Debug.cer -pfx Debug.pfx
You will then end up with three files, the .cer file (public key), the .pvk (private key), and the .pfx (key exchange with both). You can then install the .pfx file on the server like so:
certutil -p "" -importPFX Certificates\Debug.pfx
At the client end, you only need to install the .cer file. These installs (.cer and .pfx above) you can also do through the Certificates MMC snap-in (Start, Run, MMC.exe, then add the Certificates snap-in for the current machine).
Read this (covers https case but still may help) and this.
Since we are talking about transport-level security, I don't think your server process should know anything about certificate you are using to provide it.