Error message when you try to import a certificate backup file in Internet Information Services 6.0: "Cannot import Key Ring backup file" (892987)


The information in this article applies to:

  • Microsoft Internet Information Services version 6.0

SYMPTOMS

In Microsoft Internet Information Services (IIS) 6.0, when you try to import an IIS 4.0 certificate backup file, you may receive the following error message:
Cannot import Key Ring backup file. Either you entered the wrong password for this file or certificate is expired
You may experience this problem when the following conditions are true:
  • The certificate backup file that may be referred to as the key ring backup file exists on the target server in the certificate store.
  • You use the IIS Management Microsoft Management Console (MMC) snap-in to import the certificate backup file.

CAUSE

This problem occurs because the IIS Management MMC snap-in does not correctly handle errors that are returned by CryptoAPI when you perform a certificate import.

WORKAROUND

To work around this problem, use one of the following methods:

Method 1

Delete the existing copy of the certificate from the local computer store. Then, import the key ring backup file by using the IIS MMC snap-in. To import a key file from another server, follow these steps:
  1. Click Start, click Run, type mmc, and then click OK.
  2. Click the Personal folder.
  3. Right-click All Tasks, and then click Import.
  4. In the Import Wizard, click Next.
  5. Make sure that the key file is listed, and then click Next.
  6. Type the password for this file.
  7. Click to select the Mark the private key as exportable check box.
  8. Leave the import setting as Automatically, and then click Next.
  9. Click Finish.

Method 1

Follow these steps to make sure that the certificate in question is already in the local store:
  1. In the Computer Management tool, expand Services and Applications, expand Internet Information Services (IIS) Manager, and then expand Web Sites.
  2. Locate your Web site, right-click the Web site, and then click Properties.
  3. In the YourWebSite Properties dialog box, click the Directory Security tab, and then click Server Certificate.
  4. In the Welcome to the Web Server Certificate Wizard, click Next, click Assign an existing certificate, and then click Next.

    The certificate in question should appear in the IIS Certificate Wizard.
Modification Type:MajorLast Reviewed:12/13/2005
Keywords:kbprb KB892987 kbAudDeveloper
©2004 Microsoft Corporation. All rights reserved.