Questions about Enabling HTTPS using the Config Wizard and certificate(s) not being recognized

When you open IIS do you see your cert in the drop-down list?

Short answer: Nothing shows up in the IIS drop down...so I did some troubleshooting, and now I can see my cert in the IIS drop down, but not in the Config Wizard drop down (even when "run as" admin).

Long answer:  Apparently part of the IIS cert validation (to have it show up in the list) is that the certificate has to have a private key attached to it.  My cert did not (I was given, and imported a .cer file from our internal CA). More reading led me to believe that just importing the cert via MMC (or maybe IIS)  should attach a private key (it apparently does not in some cases).  Even more reading leads to an MS supplied exe called "certutil.exe" that actually attaches a key (not sure where the keys come from when doing this) to the already imported cert: https://support.microsoft.com/en-us/help/889651/how-to-assign-a-private-key-to-a-new-certificate-after-you-use-the-cer

So now I can see my cert in the IIS drop down when binding https....well, apparently since my cert does not have a "Subject Name" in it the cert shows up in the list as the thumbprint of the cert, not something that's easily identifiable to a casual user, but it works.  Also in the list are the other "SolarWinds" related certs.

In the SolarWinds Config wizard, no certs appear in the drop down list.

On windows when you generate a CSR (Certificate Signing Request) to generate the public and private key for the certificate.

When you present the CSR it has your pblickkey attached to it, the Certificate Authority then signs your public key by attaching their certificate to it

finally, when you import the signed public key it should automatically attach it to the signed public key.

When a certificate is renewed windows certmanager has an issue: you need to attach the old private key to the new public key (this has happened a lot recently over the digikey/symantic merger) which is the case you may have hit...

Richard

Based on what you're saying...and adding info on what I'm doing to generate the CSR:

When generating the CSR (we're not renewing it), we're choosing a template someone on our CA side created (and we are using MMC to generate the request, not IIS).  In the template there are tabs for adding a private key but they are empty (we cannot edit them).  So I guess the keys, if not provided manually, are supposed to be generated/held/stored on the server side "by something". I believe I shouldn't be able to send a new CSR without keys "from somewhere".  I don't get anything related to "and here are your keys" when I submit it, so I feel like I'm not supposed to/need have these keys when using Windows to generate a website cert.  Other things I read on the net are all about "start by generating your keys....never lose the keys or passphrase!" so maybe Windows is trying to help me by hiding all the details for this particular type of "simple, locally hosted website cert"

So.... maybe people handling things on the CA side are not sending the keys with the cert somehow (a.k.a. somehow exporting the cert without them?) or are not signing it (even though the cert I have has a chain of certs in it that look like they attached their certs to it).  From what little I've seen on the CA side it seems like they get a request, and then they "approve it", so I don't understand how my cert could come back to me "keyless", as the initial keys I sent should at least be attached?  Or is "keyless" meaning "the public key from the CA is not there".

Also: I don't know how I can have a cert that IIS sees as valid, but the SolarWinds config wizard does not see as valid, unless one of them is going further to check it's actually "valid".

Update: I had a new cert issued, and it "looks better" than the first (the first was probably exported incorrectly) but the new cert is still not showing up in the Orion config wizard as a choice when I set the "Enable HTTPS" option.

FYI: The cert does show up in the IIS manager as cert I can use/select when binding, but the Orion Config Wizard -> Website form shows nothing in the drop down except "Generate Self Signed Certificate".  The root cert authority and intermediate/issuing authority in my new cert appear to be on my system as "trusted certs"....so I'm at a loss as to why the config wizard refuses to allow me to choose it.

Found what it is/was:

You HAVE to have a Common Name (CN) field set or the Config Wizard will not allow you to pick the certificate for HTTPS.  Additionally, from (Configure the Orion Web Console to use SSL - SolarWinds Worldwide, LLC. Help and Support ) , the Common Name has to be certain variants of the server hostname the certificate is for to get a "green checkmark" for the cert in the Config Wizard UI (not required, but the reasons are documented in the links above)... and who doesn't want a nice green check mark!?

In addition, in the link, I believe any cert determined to be "invalid" will not show up as a choice in the drop down.  There are a few conditions listed.  I guess the "Common Name" (CN) field is also required or it's considered invalid, which should probably be in the documentation

I was following an internal procedure to generate certs from our internal CA, and putting in a Common Name wasn't listed as a "to do", which caused me to have this issue.

Per a separate conversation, thanks to neomatrix1217 for pointing me to the log @ "C:\ProgramData\SolarWinds\Logs\Orion\ConfigurationWizard.log".  It appears if you look for lines with "CertificatesHelper" you can see the certs that are "considered" for the drop down and if they were skipped there's a note as to why they were skipped.