Forum Discussion
How do I create a new certificate for Windows Admin Center??
I would like to share my experience with WAC as I am using it to administer a Windows Hyper-V Server 2019 (Bare Metal, not domain joined) and to overcome the self-signed certificate issue.
Initial information on how to generate the Root Certificate Authority and a client certificate is here - https://learn.microsoft.com/en-us/dotnet/framework/wcf/feature-details/how-to-create-temporary-certificates-for-use-during-development
Below is the script I adjusted for my usage (The server has an internal static IP address and only a computer name (hostname)):
# 19.04.2023
# Create a root certificate authority and specify the IP Address and DNS Hostname
# The certificate is valid for 20 years
$rootCert = New-SelfSignedCertificate -CertStoreLocation Cert:\CurrentUser\My -Subject "Root CA For Windows Admin Center" -TextExtension @("2.5.29.19={text}CA=true","2.5.29.17={text}IPAddress=<IP Address>&DNS=<Hostname>") -KeyUsage CertSign,CrlSign,DigitalSignature -NotAfter (Get-Date).AddYears(20)
# Password protect and export the root certificate authority to be imported on the target machine (client)
[System.Security.SecureString]$rootCertPassword = ConvertTo-SecureString -String "password" -Force -AsPlainText
[String]$rootCertPath = Join-Path -Path 'cert:\CurrentUser\My\' -ChildPath "$($rootCert.Thumbprint)"
Export-Certificate -Cert $rootCertPath -FilePath 'RootCA.crt'
# Create a self signed client certificate and specify the IP Address and DNS Hostname
# Certificate is valid for 10 years
$testCert = New-SelfSignedCertificate -CertStoreLocation Cert:\LocalMachine\My -Subject "Windows Admin Center (Self-Signed)" -TextExtension @("2.5.29.17={text}IPAddress=<IP Address>&DNS=<Hostname>") -KeyExportPolicy Exportable -KeyLength 2048 -NotAfter (Get-Date).AddYears(10) -KeyUsage DigitalSignature,KeyEncipherment -Signer $rootCert
# Add the certificate to the certificate store and export it
[String]$testCertPath = Join-Path -Path 'cert:\LocalMachine\My\' -ChildPath "$($testCert.Thumbprint)"
# Export-PfxCertificate -Cert $testCertPath -FilePath testcert.pfx -Password $rootCertPassword
Export-Certificate -Cert $testCertPath -FilePath testcert.crt
Afterwards import the RootCA.crt and testcert.crt to the client workstation:
certmgr => Personal => All Tasks => Import => testcert.crt
certmgr => Trusted Root Certification Authorities => All Tasks => Import => RootCA.crt
Reconfigure the WAC installation on the server by using the installation MSI and specify the thumbprint from the installed client certificate. To obtain it, either check the certificate store on the server or on the client workstation click on the imported testcert.crt in certmgr and under "Details" copy the value for "Thumbprint"
This method still works in v2410. But need to add permissions on the Certificate.
In brief, after WAC's install, go to `mmc.exe`
- `mmc.exe` - File - Add or Remove Snap-ins and select Certificates.
- Please note that certificates under LocalMachine cannot be managed by certmgr.msc. - LocalMachine - Personal - Certificates - find the Client_Cert you just installed.
- Right click - All Tasks - Manage Private Keys
- In the Security dialogue box, click the Add button
- In the text box, type ‘Network Service’ (case does not matter). Click Check Names to ensure that you have entered the correct name.
When you return to the Security dialogue box, an item named NETWORK SERVICE will appear Windows will give it Full Control permissions by default. Please reduce/check it to Read only. Click OK.
The WAC will now open normally.
I wrote a complete instruction here (for non-Chinese users, maybe you can use a web translator):https://blog.infrost.site/2025/02/06/WindowsAdminCenterInstall2410/
or look up this reference:
https://projectrunspace.org/windows-admin-center-v2-with-certificate-cannot-load-site/Hi,
For those who have the issue with the latest WAC (Release 2410) the permissions can be changed inside the Host Windows Server without using MMC if you have either Hyper-V Server 2019 or a Windows Server instance without Desktop Experience (Server Core)
The instruction is here - https://www.server-world.info/en/note?os=Windows_Server_2025&p=admin_center&f=1
Section [2] - Change the access permission of the private key of the SSL/TLS certificate so that it can be used with Windows Admin Center.
To change the default self-signed certificate in WAC, you have to use the PowerShell module - https://learn.microsoft.com/en-us/windows-server/manage/windows-admin-center/deploy/install?tabs=server-core&pivots=windows-server-2022#update-the-certificate-used-by-windows-admin-center
!NB - The SubjectName parameter is always without "CN=" when passing it through the Set-WACCertificateSubjectName and Set-WACCertificateAcl commands
- `mmc.exe` - File - Add or Remove Snap-ins and select Certificates.
Unfortunately this doesn't seem to work anymore with v2410.
It just yields "connection refused."
I just upgraded to v2410 and the "connection refused" error is caused due to the service crashing.
This is what I could find in event viewer:
Description: The process was terminated due to an unhandled exception. Exception Info: System.InvalidOperationException: The requested certificate PWDVANB20001.local could not be found in LocalMachine/My with AllowInvalid setting: False. at Microsoft.AspNetCore.Server.Kestrel.Https.CertificateLoader.LoadFromStoreCert(String subject, String storeName, StoreLocation storeLocation, Boolean allowInvalid) at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Certificates.CertificateConfigLoader.LoadFromStoreCert(CertificateConfig certInfo) at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Certificates.CertificateConfigLoader.LoadCertificate(CertificateConfig certInfo, String endpointName) at Microsoft.AspNetCore.Server.Kestrel.Core.TlsConfigurationLoader.ApplyHttpsConfiguration(HttpsConnectionAdapterOptions httpsOptions, EndpointConfig endpoint, KestrelServerOptions serverOptions, CertificateConfig defaultCertificateConfig, ConfigurationReader configurationReader) at Microsoft.AspNetCore.Server.Kestrel.KestrelConfigurationLoader.Reload() at Microsoft.AspNetCore.Server.Kestrel.KestrelConfigurationLoader.LoadInternal() at Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServerImpl.BindAsync(CancellationToken cancellationToken) at Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServerImpl.StartAsync[TContext](IHttpApplication`1 application, CancellationToken cancellationToken) at Microsoft.AspNetCore.Hosting.GenericWebHostService.StartAsync(CancellationToken cancellationToken) at Microsoft.Extensions.Hosting.Internal.Host.<StartAsync>b__15_1(IHostedService service, CancellationToken token) at Microsoft.Extensions.Hosting.Internal.Host.ForeachService[T](IEnumerable`1 services, CancellationToken token, Boolean concurrent, Boolean abortOnFirstException, List`1 exceptions, Func`3 operation) at Microsoft.Extensions.Hosting.Internal.Host.StartAsync(CancellationToken cancellationToken) at Microsoft.WindowsAdminCenter.Core.HostingRuntime.StartAsync(CancellationToken cancellationToken) at Microsoft.WindowsAdminCenter.Executable.WindowsService.OnStart(String[] args) at System.Threading.Tasks.Task.<>c.<ThrowAsync>b__128_1(Object state) at System.Threading.ThreadPoolWorkQueue.Dispatch() at System.Threading.PortableThreadPool.WorkerThread.WorkerThreadStart()
I have tried this approach with several Certificates:- Self Signed
- No self-signed, certificate (official)
- .cert, .pfx (pwd and no pwd), and p12
No luck making this work
did you find any solution, last week did a fresh install, and generate new certificate following the DOC of WAC but this break the system, I am using core, so I am having a lot of issue solving this.
awesome job, have a few servers so I used variables for IP/HostName
# Create a root certificate authority and specify the IP Address and DNS Hostname # The certificate is valid for 20 years $myIP = "192.168.0.0" $myHostName = "hostname" $rootCert = New-SelfSignedCertificate ` -CertStoreLocation Cert:\CurrentUser\My ` -Subject "Root CA For Windows Admin Center - $myHostName" ` -TextExtension @("2.5.29.19={text}CA=true","2.5.29.17={text}IPAddress=$($myIP)&DNS=$($myHostName)") ` -KeyUsage CertSign,CrlSign,DigitalSignature ` -NotAfter (Get-Date).AddYears(20) # Password protect and export the root certificate authority to be imported on the target machine (client) [System.Security.SecureString]$rootCertPassword = ConvertTo-SecureString -String "password" -Force -AsPlainText [String]$rootCertPath = Join-Path -Path 'cert:\CurrentUser\My\' -ChildPath "$($rootCert.Thumbprint)" Export-Certificate -Cert $rootCertPath -FilePath "RootCA_$($myHostName).crt" # Create a self signed client certificate and specify the IP Address and DNS Hostname # Certificate is valid for 10 years $testCert = New-SelfSignedCertificate ` -CertStoreLocation Cert:\LocalMachine\My ` -Subject "Windows Admin Center - $myHostName - (Self-Signed)" ` -TextExtension @("2.5.29.17={text}IPAddress=$($myIP)&DNS=$($myHostName)") ` -KeyExportPolicy Exportable ` -KeyLength 2048 ` -NotAfter (Get-Date).AddYears(10) ` -KeyUsage DigitalSignature,KeyEncipherment ` -Signer $rootCert # Add the certificate to the certificate store and export it [String]$testCertPath = Join-Path -Path 'cert:\LocalMachine\My\' -ChildPath "$($testCert.Thumbprint)" # Export-PfxCertificate -Cert $testCertPath -FilePath testcert.pfx -Password $rootCertPassword Export-Certificate -Cert $testCertPath -FilePath "clientcert_$($myHostName).crt"
