Description:

Users attempt to go to the Specops Password Reset page, and they encounter the error below:

You check the Specops Password Reset Service on your Specops Password Reset Server and find that it is not running. When you attempt to start it, the service fails to start.

In the Event Viewer, Windows Logs, Application logs on the Specops Password Reset server you might see an error from Specops Password Reset that says this:

Service failed to start (Initializing ServiceHost)

System.InvalidOperationException: Cannot find the X.509 certificate using the following search criteria: StoreName ‘My’, StoreLocation ‘LocalMachine’, FindType ‘FindByThumbprint’, FindValue ‘XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX’.

Causes:

Two potential causes for this error:

1. The certificate that was selected during the Specops Password Reset Server install is wrong, or non-working. If Specops Password Reset has never worked, this is the most likely cause.

2. The certificate that was selected during the Specops Password Reset Server install, was deleted from the server, or replaced. If Specops Password Reset was working fine, and suddenly you started seeing this error, then this is most likely the cause.

The Specops Password Reset Server should use a self-signed certificate as the recommended configuration. It is only during the web server installation(s) that you select another type of certificate, for instance, an SSL certificate. The Specops Password Reset Web is a different part of the install, and the certificate for the web install does not have to be self-signed.

In both scenarios 1 and 2 above, there are two methods to resolve the issue.

Solutions:

You have multiple methods to fix this issue, whichever you feel most comfortable with.

Option 1 – Reinstalling the Specops Password Reset Server.

1. Before you start you will need some information.
   • Service Account used for Specops Password Reset – You can find this by opening services.msc, open up the Specops Password Reset Server service, and look at the Log on tab. You will be asked for this account, and it’s password during the re-install.
   • Manage Scope – This is what users are being managed by Specops Password Reset. Open the registry on your Specops Password Reset Server, browse to HKEY_LOCAL_MACHINE\SOFTWARE\SpecopsSoft\Specops Password Reset\Server\Domains\yourdomain, and copy the value in the Scope key. You will need to know this for the reinstall.
2. Uninstall the password reset server component in “Programs and Features”.
   
3. Run the Specops Password Reset setup assistant again, choose Start Installation, and choose “Server”.
4. Select an existing self-signed certificate, or if you are uncertain, click on the “Create Self-signed Certificate” button.
5. Finish the installation and if the Specops Password Reset service is not already up and running, start it from “Services”.

Option 2 – Edit the Specops Password Reset configuration to use a valid certificate thumbprint

1. Before modifying the configuration, you will need to have the thumbprint for a valid certificate to use.
   • Open your Computer Certificates on your Specops Password Reset Server.
   • Under Personal, and Certificates find a certificate to use.
   • Our recommendation is to use a self-signed certificate.
   • Double click the certificate you want to use, go to the Details tab, and scroll down to Thumbprint.
   • Grab the thumbprint, and put it into something lime notepad.
   • Remove all of the spaces in the thumbprint.
2. Open the file C:\Program Files\Specopssoft\Specops Password Reset\Server\Specopssoft.SpecopsPasswordReset.Server.exe.config in Notepad(or whichever editor you use) as Administrator.
3. Look for following line in the file.

<serviceCertificate storeName="My" x509FindType="FindByThumbprint" findValue="9999999999999999999999999999999999999999" storeLocation="LocalMachine"/>

4. Replace the thumbprint in quotes in findValue=”9999999999999999999999999999999999999999″ with the thumbprint you grabbed in step 1, so that it looks like this findValue=”yourthumbprintvalue”

5. Save the the file, and now restart your Specops Password Reset service on your Server. The service should start normally.

You should now be up and running.