Error using Setkey in IIS 4

From: Bruce Lautenschlager (brucel@pobox.com)
Date: 11/27/02


From: "Bruce Lautenschlager" <brucel@pobox.com>
Date: Wed, 27 Nov 2002 14:37:58 -0500


I run a couple of different IIS 4 and 5 servers here at
work. I needed to install a Verisign certificate on 2 of the
IIS 4 servers. No big deal, I do that all the time. One went
without issue. The other (NT 4 Server SP6A) won't run Key
Manager from the management console. It gives an error
message "IIS WWW Configuration - The system cannot find the
file specified".

So I resort to using Keygen and Setkey from the command
line. Good old command line stuff, just like the old days.

I generate a request with Keygen without issue (really!).
But I can't seem to import the certificate that comes back
using Setkey. The parameters seem really simple (and I
import Verisign certs to IIS and Domino servers all the
time - so I know how to copy and paste the cert- no trailing
characters, etc.) but I receive an error message trying to
use it. I use the command:

setkey password privkey.txt newcert.cer www.mydomain.com

and I get the error message:

Keycheck failed with error 0x80090308
Failed to set the keys in the registry

I tried specifying paths for the key and certificate - same
message. I tried reapplying SP6A and other IIS patches. I
was hoping that would fix the Management Console issue,
really, not the command line issue. But it didn't. I
wouldn't like to reinstall IIS - this has been a perfectly
stable server, so I hate to start dorking with it.

I should mention that this server was struck by the Nimda
virus waaaaaay back in the first couple days of that virus
(and yes, I have a site license from Network Associates for
Virus Scan, but the virus hit 8 hours before the update was
available). I cleaned it using McAfee Virus Scan, but it's
never really been the same. I can't edit HTML files on it
with anything but Notepad, for example. I had to reinstall
IE to get it to work. But the IIS part chugs along. And
since it only hosts my GroupWise Webaccess piece (just the
.exe, a truly light load), I have let it be.

I have poured over the forums for hours and I have seen 2
other posts with this same message, one from 1997 and one
from 1999. But no one offered (or posted their) solutions.

Any help would be *greatly* appreciated - else I guess I
resort to reinstalling IIS and go from there.

Bruce Lautenschlager
Technical Analyst, MCSE
Bethesda Healthcare System
Boynton Beach, FL
brucel@spamless.pobox.com



Relevant Pages

  • RE: Should webservers, eg. IIS 6 have anti--virus installed on th em?
    ... Should webservers, eg. IIS 6 have anti--virus installed on ... recognized by most virus scanners until long after the fact. ... servers alike via IIS servers, but it doesn't preclude future mechanisms of ...
    (Focus-Microsoft)
  • Re: Microsoft Security Advisory MS 03-007
    ... > You say "IIS servers are actively being compromised already, ... -- permissions are checked on httpext.dll to see if Anonymous request using ... CONFIGURATIONS OF THE IIS LOCKDOWN TOOL DO LEAVE WEBDAV ...
    (Focus-Microsoft)
  • RE: Microsoft Security Advisory MS 03-007
    ... announcement covers IIS 5.1 but not IIS 6, ... > You say "IIS servers are actively being compromised already, ... -- permissions are checked on httpext.dll to see if Anonymous request ... CONFIGURATIONS OF THE IIS LOCKDOWN TOOL DO LEAVE WEBDAV ...
    (Bugtraq)
  • Re: Microsoft Security Advisory MS 03-007
    ... announcement covers IIS 5.1 but not IIS 6, ... > You say "IIS servers are actively being compromised already, ... -- permissions are checked on httpext.dll to see if Anonymous request ... CONFIGURATIONS OF THE IIS LOCKDOWN TOOL DO LEAVE WEBDAV ...
    (Bugtraq)
  • RE: Microsoft Security Advisory MS 03-007
    ... announcement covers IIS 5.1 but not IIS 6, ... > You say "IIS servers are actively being compromised already, ... through, and if it carried the exploit, compromise could occur. ... CONFIGURATIONS OF THE IIS LOCKDOWN TOOL DO LEAVE WEBDAV ...
    (Focus-Microsoft)