Certificate is installed but application rejects it
Documentation: Microsoft Learn
Work the problem
The certificate is present
Fictional case: A certificate appears in CurrentUser\My for your administrator account. The application runs as a Windows service under a different identity.
Reasoning notebook
Record the evidence that supports your answer and the check you would run next. Your notes stay in this browser — nothing is uploaded.
Why it happens
Applications check considerably more than validity. They need the private key present and readable by the service account, an Enhanced Key Usage permitting the intended role, a subject alternative name matching the requested host name, and a chain that builds to a root the client trusts. Any single failure among those presents as a certificate that simply does not work.
Check this first
What to look for
Presence in your profile does not establish availability to the service. Check store selection, matching certificate and key permissions.
Working through it
- List the store and confirm HasPrivateKey reads True for the certificate you intend to use.
- Read EnhancedKeyUsageList and check that Server Authentication appears in it.
- Inspect the SAN entries with certutil, because current clients ignore the common name entirely.
- Grant the service account read access to the private key through the Manage Private Keys dialog or certutil.
- Run certutil -verify against the certificate to confirm the chain builds on that specific machine.
Avoiding it next time
Verify the repair: Confirm the application selects the intended certificate and completes its real TLS or signing operation under the service identity.