Problems using gMSA account for PSU service - Cert error

[adam]

I made a script to help diagnosis problems like this. It replicates the certificate lookup done by ASP.NET Core (and PSU).

HTTPS certificate not found

I’ve done some digging into this. I actually recreated the CertificateLoader class used by ASP.NET in PowerShell. This is the class that is internally being used to look up the cert. Here’s that script. $allowInvalid = $true $subject = 'localhost' $store = [System.Security.Cryptography.X509Certificates.X509Store]::new('My', 'LocalMachine') $store.Open('ReadOnly') $storeCertificates = $store.Certificates; $foundCertificates = $storeCertificates.Find('FindBySubjectName', $Subject, $allowInvalid…

It’s a bit different than the Cert drive etc so it might be worth trying under your gMSA account.