title: WCF - It is likely that certificate ... may not have a private key that is capable of key exchange
body: <p>I am trying to facilitate encrypted SOAP messaging in my WCF service.  In order to do this, I have to install and configure a certificate for production.  When I use the existing machine certificate, everything works fine.  But I don't want to use that certificate, so I created a new one that I got via the Active Directory Certificate Service using the "Web Server" template.  When I implemented this certificate in the Web.config, now I receive this error message when attempting to view the WSDL:</p>
  
  <blockquote>
    <p>Keyset does not exist.
    It is likely that certificate 'CN=myservice.mydomain.com, O=My Company, L=My City, S=My State' may not have a private key that is capable of key exchange or the process may not have access rights for the private key. Please see inner exception for detail.</p>
  </blockquote>
  
  <p>I have seen plenty of help responses for this issue, but most of them just assume that I have a permissions issue, or that my cert is in the wrong store, or that my application pool is running under a different account.  </p>
  
  <p>Here is a summary of everything I have checked:</p>
  
  <ol>
  <li>I have confirmed (using winhttpcertcfg and MMC) that my certs are in the same store (LOCAL_MACHINE\My) and they both have the same rights assignments.</li>
  <li>I have confirmed my IIS app pool is running under the NETWORK SERVICE and even tried restarting the pool.</li>
  <li>Both certificates are issued and signed by the same CA, which is in the Trusted Root CA store folder.</li>
  <li>Both certificates show the Key Usage as "Digital Signature, Key Encipherment (a0)"</li>
  </ol>
  
  <p>Is there something else I need to look at to ensure that my new cert is capable of key exchange?</p>