Context
An administrator can see a certificate in Windows, but a service reports that it cannot use it. Certificate visibility, private-key presence and permission to perform a private-key operation are different checks. The service may also search a different store scope from the administrator's interactive account.
Prepare the application certificate requirements, configured thumbprint or selection rule, runtime identity and expected store. Know whether the certificate is used for server identity, client authentication or signing. Use a non-production certificate for reproduction where possible. Do not export private keys merely to move diagnostics between engineers.
Inspect scope and key availability
- Determine the service's actual account and application selection configuration. Review the expected store location and store name from the product's documentation. A certificate in an administrator's Current User Personal store is not automatically the certificate a machine service will find. Thumbprint-based selection also needs review after renewal, because a new certificate has a new identity.
- Inspect the correct store with the Certificates MMC snap-in or the PowerShell Certificate provider. For example,
Get-ChildItem Cert:\LocalMachine\Myreads the computer Personal store. Use the exact approved scope and inspect subject, issuer, validity, thumbprint, intended usage and private-key presence. Keep internal names out of broadly shared transcripts. - Check whether the service identity can use the associated private key through the supported certificate/key-management interface. A public certificate can be present while its private key is absent, stored through a provider the application cannot use or inaccessible to the account. Administrator success does not prove service-account success.
- Review the certificate chain and application requirements separately. Correct key access does not fix an inappropriate extended key usage, expired certificate or unsupported key provider. Match the test to the application's actual operation, not simply opening the certificate viewer without an error.
An illustrative renewal regression
In an illustrative integration service, a renewed client certificate is imported successfully into the computer store. The old certificate's key access was configured for the service account, but the new private key lacks that access. The application finds the certificate and then fails when signing authentication data. Broadly granting access to every machine key would be an unnecessary and dangerous correction.
| Observation | Evidence to inspect | Boundary |
|---|---|---|
| Certificate visible only to admin | Store scope and application lookup | Selection context |
| Certificate has no private key | Import/enrollment result | Key material availability |
| Admin operation works, service fails | Runtime identity and key access | Private-key authorization |
| Renewal present, app selects old item | Thumbprint or selection rule | Application activation |
Correct and verify the service relationship
Install or enroll through the supported process and grant only the intended identity the required private-key use. Preserve the previous valid certificate through the approved transition window. Do not change trusted-root stores to repair a missing private key; those stores govern a different trust relationship.
Verify an application-level signing or authentication operation under the service identity. Confirm the selected certificate thumbprint and validity without logging key material. Test a supported service restart or refresh to ensure renewal activation survives a new lifecycle. Check both local execution and the actual remote peer's acceptance.
Maintain renewal acceptance
Document store, selection rule, provider, account, key-access owner and renewal activation steps. Monitor expiry and certificate-use failures separately. Include a private-key operation in renewal acceptance, rather than checking certificate presence alone. Clouvenix Windows administration can help make service-certificate handling repeatable.
Technical reference
Windows certificate-store inspection, scope selection and private-key access distinction.