The Token Issuer is not a trusted issuer

Question

When trying to deploy a custom STS (Functioning when used with a custom MVC app) I get the following error:

`The Token Issuer is not a trusted issuer`

It seems to be an issue with the certificates themselves. I am installing the certificates as below (using powershell) which does not cause errors.

$ap = Remove-SPTrustedIdentityTokenIssuer " SAML Provider"
Remove-SPTrustedRootAuthority "Token Signing Cert"
Remove-SPTrustedRootAuthority "Token Signing Cert Parent"

$certStore = “My”
$cerPass = "password123"
$certLocation = "LocalMachine"
$parentPath = resolve-path ".\CARoot.cer"
$certPath = resolve-path ".\STS_DEV_AllPurposes_Exportable.cer"
$parent = new-object System.Security.Cryptography.X509Certificates.X509Certificate2($parentPath);
$cer = new-object System.Security.Cryptography.X509Certificates.X509Certificate2($certPath);

#$store = new-object System.Security.Cryptography.X509Certificates.X509Store($certStore,$certLocation)    
#$store.open("MaxAllowed")    
#$store.add($cer)    
#$store.close() 

New-SPTrustedRootAuthority -Name "Token Signing Cert Parent" -Certificate $parent


New-SPTrustedRootAuthority -Name "Token Signing Cert" -Certificate $cer

$map = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.microsoft.com/ws/2008/06/identity/claims/Client" -IncomingClaimTypeDisplayName "client" -SameAsIncoming

$realm = "http://<MachineName>:<Port>"

$ap = New-SPTrustedIdentityTokenIssuer -Name "SAML Provider" -Description "Custom SAML provider for Web" -realm $realm -ImportTrustCertificate $cer -ClaimsMappings $map -SignInUrl "http://<MachineName>:812/Authenticate" -IdentifierClaim "http://schemas.microsoft.com/ws/2008/06/identity/claims/Client"

however if I try to install the same certificates through the GUI I get the following errors

• The Root Certificate that was just selected is invalid. This may be because the selected certificate requires a password and we do not support certificates that require a password. Please select another certificate.
• The STS Certificate that was just selected is invalid. This may be because the selected certificate requires a password and we do not support certificates that require a password. Please select another certificate.

Answer 1

I would trust that the error messages from the UI are pointing to the problem.

Answer 2

I was having this issue too. I tried the PowerShell way that you said worked. However that failed as well for me w/ some cryptographic exception. So I did this which I think will work for you as well:

1. Import the cert into the Windows cert store
2. Open the property page of the cert by double-clicking it in Windows Explorer
3. Copy the thumbprint from the bottom of the listview on the details tab

4. Run the following PowerShell commands:

   $c = Get-Item(“cert:\CurrentUser\My\” + “<FINGERPRINT>”.Replace(“ “, “”).ToUpper())
   New-SPTrustedRootAuthority -Name "Token Signing Cert" -Certificate $c

(Obviously, paste the fingerprint from the details tab into the command where <FINGERPRINT> is.)