Failed to acquire certificate private key provider. Error=0x80090016

Technical Articles ID: KB86778
Last Modified: 2023-07-18 11:59:15 Etc/GMT

Environment

ePolicy Orchestrator (ePO) 5.x

Problem

During startup of the ePO Server service (Apache), the service tries to re-create the server certificate. Although successful, Apache is unable to use the certificate and fails.

The server.log records the following errors.

Failed to acquire certificate private key provider. Error=0x80090016
Failed to process server key information

NOTE: The error message contains a typographical error. But, it's reproduced to show how the error actually appears in the product.

After the error above occurs, no agent-to-server communication is possible.

Cause

The ePO Server service component provided by Apache uses a certificate for secure communication with client systems. This certificate is created during the installation of ePO. A new certificate can be created if needed using the RunDllGenCerts command, as described in KB66616 - ePolicy Orchestrator server backup and disaster recovery procedure. The certificate generation process relies on the underlying Windows operating system. If the permissions on certain folders are incorrect, this process fails.

The permissions on the folder %ALLUSERSPROFILE%\Microsoft\Crypto\RSA\MachineKeys must be as described in this Microsoft Support document.

Solution

To resolve the issue, correct the folder permissions and generate a new certificate for Apache:

Stop the ePO Server service:
1. Click Start, Run, type services.msc, and click OK.
2. Right-click the following service and select Stop:
  
  McAfee ePolicy Orchestrator x.x.x Server
Set the permissions on the folder %ALLUSERSPROFILE%\Microsoft\Crypto\RSA\MachineKeys, as described in this Microsoft Support document.
Generate a new certificate for Apache, as described in KB66616 - ePolicy Orchestrator server backup and disaster recovery procedure:
1. Rename the SSL.CRT folder (see path below) to SSL.CRT.OLD. Then, manually create an empty folder named SSL.CRT in the same path; otherwise, the setup fails to create the certificate:
  
  64-bit: "C:\Program Files (x86)\McAfee\ePolicy Orchestrator\Apache2\conf\ssl.crt"
  32-bit: "C:\Program Files\McAfee\ePolicy Orchestrator\Apache2\conf\ssl.crt"
2. Click Start, type cmd in the search field, right-click, and select Run as administrator.
3. Change directories to your ePO installation directory.
  
  Default paths:
  
  64-bit: Program Files (x86)\McAfee\ePolicy Orchestrator\
  32-bit: Program Files\McAfee\ePolicy Orchestrator\
4. Run the following command:
  
  Rundll32.exe ahsetup.dll RunDllGenCerts <ePO_server_name> <console_HTTPS_port> <admin_username> <password> <"install_folder\Apache2\conf\ssl.crt">
  
  Here:
  
  <ePO_server_name> - Your ePO server NetBIOS name
  <console_HTTPS_port> - Your ePO console port (default is 8443)
  <admin_username> - The administrator (use the default ePO administrator console account)
  <password> - The password to the ePO administrator console account
  <install_folder\Apache2\conf\ssl.crt - The path to the Apache folder. The default path is as follows:
  
  64-bit: "C:\Program Files (x86)\McAfee\ePolicy Orchestrator\Apache2\conf\ssl.crt"
  32-bit: "C:\Program Files\McAfee\ePolicy Orchestrator\Apache2\conf\ssl.crt"
  
  Example
  
  Rundll32.exe ahsetup.dll RunDllGenCerts eposervername 8443 administrator password "C:\Program Files\McAfee\ePolicy Orchestrator\Apache2\conf\ssl.crt"
  
  IMPORTANT:
  - This command fails if you've enabled User Account Control (UAC) on this server. If the server is running Windows Server 2008 or later, disable this feature. For more information, see this Microsoft Support document.
  - This command is case-sensitive. The ahsetup.log (located in installdir\Apache2\conf\ssl.crt) provides information about whether the command succeeds or fails. It states whether it uses the files located in the ssl.crt folder.
Start the ePO Server service:
1. Click Start, Run, type services.msc, and click OK.
2. Right-click the following service and click Start:
  
  McAfee ePolicy Orchestrator x.x.x Server

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Failed to acquire certificate private key provider. Error=0x80090016

Environment

Problem

Cause

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

Failed to acquire certificate private key provider. Error=0x80090016

Environment

Problem

Cause

Solution

Affected Products

Languages:

Choose your region

Title

Title