title: WCF, Certificate Authentication - Common Errors and Confusing Arguments
body: <p>I am trying to setup a WCF service to use a Certificate for Authenticating the client. I have read tons of posts on how to create the certificate, and I have been able to do so (finally). </p>
  
  <p>I am installing the Cert Authority and the Cert on a server that runs Windows 2008 R2. When I open the MMC Certificates Snap-in, I choose <strong>Computer Account</strong>. Is this correct? I am doing this because my WCF service will run in a Windows Service, and will be running even when no user's are logged in. But admittedly, I don't know what the difference is between the three options: </p>
  
  <ol>
  <li>My user account</li>
  <li>Service account</li>
  <li>Computer account</li>
  </ol>
  
  <p>Once the snap-in loads, I import the Authority Cert into <strong>Trusted Root Certification Authorities</strong>. Then, I import the cert into <strong>Trusted Publishers</strong>. I don't encounter any errors when doing this. When I do the import, of both the Authority Cert and the Cert signed by that authority, I don't make any reference to the .pvk file. It is my understanding that the private key is embedded in either the cert or the authority cert. Here are the commands I use to create each cert:</p>
  
  <pre><code>MakeCert.exe
    -n “CN=InternalCA”
    -r
    -sv InternalCA.pvk InternalCA.cer
    -cy authority
  
  
  MakeCert.exe
    -sk InternalWebService
    -iv InternalCA.pvk
    -n “CN=InternalWebService”
    -ic InternalCA.cer InternalWebService.cer
    -sr localmachine
    -ss root
    -sky exchange
    -pe
  </code></pre>
  
  <p>Notice I used -ss root. I have seen many posts using -ss My. I don't really understand what the difference is or when it is appropriate to use each value. </p>
  
  <p>My WCF service runs on this machine inside a Managed Service (Windows Service). When I start my windows service, which hosts the WCF service, it crashes immediately and a seemingly common error is reported in the event viewer: </p>
  
  <blockquote>
    <p>System.ArgumentException: It is likely
    that certificate 'CN=TempCertName' may
    not have a private key that is capable
    of key exchange or the process may not
    have access rights for the private key</p>
  </blockquote>
  
  <p>I have found posts that say I need to grant permissions to the user running the service to the key. </p>
  
  <p>This one seems to be a popular answer here on stackoverflow: <a href="https://stackoverflow.com/questions/344590/issue-with-self-signed-cert-in-wcf-must-have-private-key/344643#344643">Grant access with All Tasks/Manage Private Keys</a></p>
  
  <p>But I don't have the option of <strong>All Tasks/Manage Private Keys</strong></p>
  
  <p>But I'm not clear on how to do that. But also, the service is running under my domain account, which is an administrator and is also the same user that installed the cert.</p>
  
  <p>Please Help :)</p>