SSL cannot find private key

ISSUE
Last week I generated a certificate request in IIS and requested an SSL certificate. Today I tried to install the recieved certificate, but after "Processing the request" the certificate was damaged. I was able to locate it in the Certificates MMC, but while trying to export the certificate the wizard came with the message "A private key cannot be found".
When I tried to apply the certificate to a IIS web site, the web site couldn't be reached using https. No error messages were reported.

TROUBLESHOOTING STEPS
I found the Microsoft SSL Diag tool on the Microsoft site and used this tool to troubleshoot. It came back with the error ""You have a private key that corresponds to this certificate but CryptAcquireCertificatePrivateKey failed"".

CAUSE
The above issue was caused by the fact that permissions on files in the following directory were incorrect:C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeysThis directory contains files with the server's private keys. Due to the incorrect permissions, was the server unable to read the certificate private keys.

RESOLUTION
I reapplied the security settings of the directory to all files by opening the properties of the directory, select the security tab, click the Advanced button, select the "Replace permission entries on all child objects with entries show here that apply to child objects" and click OK.
The server was now able to read the private key files and therefore able to use the certificate.

[MOSS/WSSv3] MOSS and WSSv3 Service Pack 1 released!

Yesterday Microsoft released Service Pack 1 for MOSS and WSSv3.

"For information on what's included in the service pack view the Announcing WSS 3.0 and MOSS SP1 article from TechNet. This information will be important from both a business and technical perspective to support installing SP1. The KB "Description of Windows SharePoint Services 3.0 Service Pack 1 and of Windows SharePoint Services Language Pack 3.0 Service Pack 1" in addition is a must read. It includes a link to a list of fixes included in WSS SP1. For Office SharePoint Server 2007 SP1 another KB has been posted with a downloadable Office Servers list of fixes."

Note: For SharePoint Server 2007 environments, WSS 3.0 SP1 should be installed before SharePoint Server 2007 SP1.

Download WSS 3.0 SP1
SP1 existing deployments:
Windows SharePoint Services 3.0 SP1, 32-bit edition and 64-bit edition
Windows SharePoint Services Language Pack 3.0 SP1, 32-bit edition, 64-bit edition

Download Office SharePoint Server 2007 SP1 (includes SP1 for Project Server, Forms Server, and Groove)
Office SharePoint Server 2007 SP1 32-bit edition and 64-bit edition
Office SharePoint Server 2007 Language Pack 3.0 SP1 32-bit edition, 64-bit edition

Download SharePoint Designer 2007 SP1
SharePoint Designer SP1
SharePoint Designer Language Pack SP1

Source: http://blogs.msdn.com/sharepoint/archive/2007/12/11/announcing-the-release-of-wss-3-0-sp1-and-office-sharepoint-server-2007-sp1.aspx

[MOSS/WSSv3] Antivirus exclusions in SharePoint 2007

A few weeks ago I installed two SharePoint 2007 (MOSS) environments at a customer. Both environments were create in VMware ESX and had one database server and one SharePoint 2007 server. The ESX administrator noticed that the CPU of both SharePoint 2007 servers used a lot of performance for about 15-20 seconds each minute. Process Explorer to the rescue!!

The System process on the server was using this CPU time and using Process Explorer I was able to track the usage to the tmxpflt.sys thread. This file was part of the TrendMicro OfficeScan product, so the CPU usage was an AV issue. I searched the Internet for antivirus exclusions for SharePoint 2007, but wasn't able to find any exclusion information for SharePoint 2007. This ment I had to do the troubleshooting myself.

After some more troubleshooting I found out that:

• The Windows SharePoint Services Timer service started a job every minute which caused the issue. When I stopped this service, the CPU didn't spike at all.
• The Windows SharePoint Services Administration service was running the job. When I stopped this service when the CPU was high, the usage immediately dropped.
• The Windows SharePoint Services Administration service was writing some logging in the file WSS_AdminService.log, which was located in the directory C:\Documents and Settings\Default User\Local Settings\Temp.
• The WSS_AdminService.log file was about 65MB. TrendMicro OfficeScan scanned the file before the Administration service was able to write in it. With 65MB, this took some time and processing power.

After deleting the log file, the CPU usage didn't spike at all, so I excluded the C:\Documents and Settings\Default User\Local Settings\Temp directory which solved all issues!

So one exclusion for your Antivirus software when using SharePoint 2007: C:\Documents and Settings\Default User\Local Settings\Temp

[MOSS/WSSv3] Moving sites between content databases

With the release of the Public Hotfix of October 9th (WSSv3 KB934525/MOSS2007 KB937832), StsAdm has gotten a new operation, the Mergedbs operation. A very cool operation, with which administrators are able to move sites from one content database to another!!

On his blog, Todd Klindt describes how to use the operation:
"On multiple occasions as a SharePoint administrator I have needed to move a Site Collection from one Content Database to another one. In the past this process was very painful and very manual. In this blog post I will show you how to move Site Collections between Content Databases with a single STSADM command using the "mergedbs" operation that was introduced in KB934525."

[MOSS/WSSv3] WSS Logs grow fast after installing patch

After installing some MOSS environments I got some messages about the logs in C:\Program Files\Common Files\Microsoft Shared\web server extensions\12\LOGS which grew enormously. In one occasion the logs became 250+ MB in half an hour, filling up the C drive rappidly.

On the Microsoft site I ran into article KB941789 which described a solution. After performing the steps, the log stops growing fast.

[MOSS] New version of the MOSS Installation Guide

I have just uploaded a new version of the MOSS Installation Guide. This time these things are added:

• Installation of Public Update of October 9th
• Default configuration steps of MOSS
• Some extra steps to correct issues with the Public Update

The new version can be downloaded here

Please let me know if you have any updates/questions about the guide by posting a comment!

Have fun installing!!

[MOSS/WSSv3] Bug in SharePoint Public Hotfix of October 9th

Recently I have installed the MOSS and WSS public hotfix of October 9th (WSS 3.0 - KB934525, MOSS 2007 KB937832) on several environments. After the installation I noticed that DCOM errors were added to the eventlogs. I troubleshooted the issues and it turns out that the WSS and MOSS patches are resetting the permissions on the OSearch and SPSearch DCOM objects.

Before installing the hotfixes the security settings on both objects were:

• Administrators
• <MOSS Configuration Database account>
• <MOSS Search account>
• SYSTEM
• WSS_ADMIN_WPG
• WSS_WPG

All account had "Local Activation" and "Local Launch" permissions.



After installing the WSS patch the security settings on the SPSearch DCOM object were reset to default settings.
After installing the MOSS patch the security settings on the SPSearch DCOM object were reset to default settings.

• Administrators
• LOCAL SERVICE
• SYSTEM

Fortunatelly this was solved easily by adding the WSS_ADMIN_WPG and WSS_WPG groups to the OSearch and SPSearch object and granting them "Local Activation" and "Local Launch" permissions.

How to determine the DCOM settings??

• Start > Run
• dcomcnfg
• Component Services > Computers > My Computer >DCOM Config
• Select object OSearch or SPSearch
• Right click > Properties
• Select tab Security
• Click Edit at "Launch and Activation Permissions"

[iFilter] Adobe released a work around for the PDF iFilter in x64

"Finally Adobe has come up with an interim solution to address the non-availability of a 64 bit ifilter. Now one can use the 32-bit Adobe IFilter on 64-bit platforms after installing a DCOM addin from Adobe. The installation instructions can be found on the Adobe Labs Wiki .

This is a great oppurtunity for folks who have a 64-bit installation of Microsoft Office Sharepoint Server 2007 and want to index pdf documents, but do not want to spend money on a 64-bit FOXIT IFilter."
Source: Filter Central

[MOSS] Do's and don'ts with SharePoint databases

On the Microsoft site I found some articles about what you can do and what you probably might not do with your SharePoint databases.

What to do with SharePoint databases:
- Information about the Maintenance Plan Wizard in SQL Server 2005 and about tasks that administrators can perform against SharePoint databases

What NOT to do with SharePoint databases:
- Support for changes to the databases that are used by Office server products and by Windows SharePoint Services

[MOSS/WSSv3] Solving issues after installing a patch

Last week I installed ForeFront for SharePoint on our SharePoint 2007 servers. Unfortunatelly the version on the CD did not contain SP1, causing some issues which were solved in SP1. So I decided to upgrade to SP1. The ForeFront Security for SharePoint blog had a post which describes how to install ForeFront Security for SharePoint SP1.

Step 1 of this description was installing the SharePoint hotfix package KB936867. After installing this patch, you are required to run the SharePoint Products and Technologies Configuration Wizard, so I did......and here is where the problems all started.

At step 7 of the Config Wizard, the wizard went into an infinite loop. A reboot was the only solution.

After the reboot, running the Config Wizard again resulted in a nice error message "The Configuration Wizard is already running on another server". I kinda was stuck. Fortunately Microsoft knew the answer to my problems. They recommended me to run the following command:

psconfig –cmd upgrade –inplace b2b –wait –force

Afterwards I also installed the public updates, released on October 9th:
Public Update October 9th - WSS3.0
Public Update October 9th - MOSS2007
Everything seemed fine.......

After a few days I noticed that on my second webserver the Status of the "Windows SharePoint Services Web Application" role was stuck on "Upgrading".On the Microsoft Forum I found the following post:
Need Help after applying Hotfix May 8 - MSDN Forums

Unfortunately the answer wasn't posted there yet, but my reply on the post got a real quick answer saying I needed to run the following command:
stsadm -o provisionservice -action start -servicetype SPWebService

This solved the issue and everything was back up and running!!