Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

When trying to deploy a custom STS (Functioning when used with a custom MVC app) I get the following error:

`The Token Issuer is not a trusted issuer`

It seems to be an issue with the certificates themselves. I am installing the certificates as below (using powershell) which does not cause errors.

$ap = Remove-SPTrustedIdentityTokenIssuer " SAML Provider"
Remove-SPTrustedRootAuthority "Token Signing Cert"
Remove-SPTrustedRootAuthority "Token Signing Cert Parent"

$certStore = “My”
$cerPass = "password123"
$certLocation = "LocalMachine"
$parentPath = resolve-path ".\CARoot.cer"
$certPath = resolve-path ".\STS_DEV_AllPurposes_Exportable.cer"
$parent = new-object System.Security.Cryptography.X509Certificates.X509Certificate2($parentPath);
$cer = new-object System.Security.Cryptography.X509Certificates.X509Certificate2($certPath);

#$store = new-object System.Security.Cryptography.X509Certificates.X509Store($certStore,$certLocation)    
#$store.open("MaxAllowed")    
#$store.add($cer)    
#$store.close() 

New-SPTrustedRootAuthority -Name "Token Signing Cert Parent" -Certificate $parent


New-SPTrustedRootAuthority -Name "Token Signing Cert" -Certificate $cer

$map = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.microsoft.com/ws/2008/06/identity/claims/Client" -IncomingClaimTypeDisplayName "client" -SameAsIncoming

$realm = "http://<MachineName>:<Port>"

$ap = New-SPTrustedIdentityTokenIssuer -Name "SAML Provider" -Description "Custom SAML provider for Web" -realm $realm -ImportTrustCertificate $cer -ClaimsMappings $map -SignInUrl "http://<MachineName>:812/Authenticate" -IdentifierClaim "http://schemas.microsoft.com/ws/2008/06/identity/claims/Client"

however if I try to install the same certificates through the GUI I get the following errors

  • The Root Certificate that was just selected is invalid. This may be because the selected certificate requires a password and we do not support certificates that require a password. Please select another certificate.
  • The STS Certificate that was just selected is invalid. This may be because the selected certificate requires a password and we do not support certificates that require a password. Please select another certificate.
share|improve this question

2 Answers 2

up vote 0 down vote accepted

I was having this issue too. I tried the PowerShell way that you said worked. However that failed as well for me w/ some cryptographic exception. So I did this which I think will work for you as well:

  1. Import the cert into the Windows cert store
  2. Open the property page of the cert by double-clicking it in Windows Explorer
  3. Copy the thumbprint from the bottom of the listview on the details tab
  4. Run the following PowerShell commands:

    $c = Get-Item(“cert:\CurrentUser\My\” + “<FINGERPRINT>”.Replace(“ “, “”).ToUpper())
    New-SPTrustedRootAuthority -Name "Token Signing Cert" -Certificate $c

(Obviously, paste the fingerprint from the details tab into the command where <FINGERPRINT> is.)

share|improve this answer

I would trust that the error messages from the UI are pointing to the problem.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.