Cannot export PKCS12; Issuer certificate hasn't been resolved

[oblaise]

Hi,

I successfully issued two certificates using 2 different manual methods (http and dns) but when I'm trying to export certificate in pkcs#12 I'm getting an error:

PS C:\inetpub\wwwroot> Get-ACMECertificate myalias -ExportPkcs12 test.p12 Get-ACMECertificate : Cannot export PKCS12; Issuer certificate hasn't been resolved At line:1 char:1

• Get-ACMECertificate myalias -ExportPkcs12 test.p12

• - CategoryInfo          : NotSpecified: (:) [Get-ACMECertificate], InvalidOperationException
  - FullyQualifiedErrorId : System.InvalidOperationException,ACMESharp.POSH.GetCertificat
  

[bseddon]

I also experienced this problem. The issue for me was that the LE intermediate certificate (Let's Encrypt Authority X1) was not in my intermediate certificates store. So I downloaded this and imported it. For me, doing so also added the certificate 'DST Root CA X3' into the Trusted Root CA store.

After adding the these certificates I was able to export the PKCS12 file.

[skfd]

@bseddon how did you do it? Having same problem here.

[bseddon]

Make sure you have issued the Update-ACMECertificate command.

When you issue the command Get-ACMEVault what do you see?

My guess is that that output will show a blank where the issuer certificates are shown. One of the actions of the update command is to fill in this blank.

[skfd]

Thank you, that actually did the trick. My steps were:

1. save 'DST Root CA X3' certificate from Let's Encrypt site and install it.
2. Update-ACMECertificate myCert

[afermon]

Same here, @skfd steps fixed the issue. Thanks

[terraslate]

It's all a bit hit and miss for me, after installing CAX3 and calling update the export works. Trying to then create another one fails with invalid data if that cert is installed for some reason. Shouldn't the code pull the latest certs from their site?

P.S I'm using the route53 provider. It would also be nice if it removed the TXT after itself as i could end up with a lot left behind. Almost all the time (98% of it) i seem to be stuck in an "invalid" loop, is there a bug perhaps somewhere in the validation logic? In my code i let this go on for 300 seconds and then call it quits.