What you’re seeing
- Binding the certificate to a site in IIS fails with error 0x80070520, saying a specified logon session does not exist.
- Exchange lists the new certificate but refuses to assign it to IIS or SMTP services.
- The certificate's details don't show that a private key is present.
- The certificate was imported from a file generated on another server or by an ACME client such as a Let's Encrypt tool.
Common causes
Every environment is different, but these are the causes our engineers find most often:
- The certificate was imported without its private key, such as from a .cer or .crt file instead of a .pfx package.
- The certificate and key landed in the current user's store rather than the local computer store, where services look.
- The private key was created with a cryptographic provider or key type the web server or Exchange can't use for binding.
- Permissions on the private key don't allow the system or service account to read it.
- The certificate request was completed on a different server than the one that generated it, so the matching key isn't there.
Why it matters
A certificate that won't bind usually shows up during a renewal, right when the old certificate is about to expire. If it does expire, customers see security warnings on your website, Outlook and mobile devices stop connecting to Exchange, and partners' mail servers may refuse encrypted delivery. Every hour of delay increases the chance of a visible outage, and rushed workarounds such as untrusted certificates teach users to ignore warnings.
How AskTechGurus fixes it
Skip the trial and error. A certified engineer works on your actual system, finds the root cause, and fixes it properly.
Tell us what’s happening
Submit a ticket in about two minutes. Paste the error, describe what changed, and pick your tier. No charge to submit.
A certified engineer diagnoses it
A vetted, US-based systems engineer claims your ticket, usually within minutes during business hours, and investigates over a secure remote session you can watch and end at any time.
Fixed and verified with you
The engineer resolves the root cause and confirms with you that it’s working. You don’t just get a workaround, and you get a plain-English summary of what was wrong.
Pay only when it’s resolved
Fixed price from $99, invoiced only after you approve the fix. If it isn’t resolved, you don’t pay.
Frequently asked questions
Is our website or email down right now?
Not necessarily. The old certificate typically keeps working until it expires, which is why it's best to resolve the binding before that date.
Do we need to buy a new certificate?
Usually not. In most cases the existing certificate can be used once the private key problem is resolved, though occasionally a reissue is the cleanest route.