"Key not valid for use in specified state" Error when generating a new certificate in a script run locally

Hi!

I ma getting the above error while installing Octopus.

I have tried options previously described in other articles with no joy; install without config generated error. using local admin account to generate. manually running new-certificate creates txt file but import fails with same error.

Attached log.

Please advise. thanks!

Error.log (38 KB)

Hi Steve,

Thanks for contacting us! Along with the log you provided, could you please also provide me with the script commands you’re using (blocking any sensitive information)? And which OS are you using? That should help us troubleshoot the issue further.

Warm regards,

Kenneth

OS: Windows 2008 R2

Please see attached.

Thanks

Steve

Hi Steve,

Sorry, we didn’t get an attachment for your scripts you’re using. If you could please try again.

Thank you!

Kenny

Hi, Sorry added to text below;

FYI, this is now impacting the rollout of Octopus to our production environment.

Please be aware a manual config generates the same error:
(and thus feels like an issue with OS Config, across two identical machines).

cd "C:\Program Files\Octopus Deploy\Tentacle"
Tentacle.exe create-instance --instance “Tentacle” --config “C:\Octopus\Tentacle.config” --console
Tentacle.exe new-certificate --instance “Tentacle” --if-blank --console
Tentacle.exe configure --instance “Tentacle” --reset-trust --console
Tentacle.exe configure --instance “Tentacle” --home “C:\Octopus” --app “C:\Octopus\Applications” --port “PORT” --console
Tentacle.exe configure --instance “Tentacle” --trust “123456” --console
Tentacle.exe register-with --instance “Tentacle” --server “http://SERVER/octopus” --apiKey=“API-ABCDEF” --role “role” --environment “Production” --comms-style TentaclePassive --console
Tentacle.exe service --instance “Tentacle” --install --start --console
net localgroup Administrators ACCOUNT /add
sc \localhost config “OctopusDeploy Tentacle” obj= ACCOUNT password= "PASSWORD"
net stop "OctopusDeploy Tentacle"
net start “OctopusDeploy Tentacle”

Hi!

Do you have any UK-Based business partners we could contact?

Thanks

Steve

Hi Steve,

We do have an excellent partner in the UK DevOpsGuys. https://www.devopsguys.com/

I have found these articles regarding the error. It appears to be mostly related to a windows update.
http://answers.microsoft.com/en-us/windows/forum/all/key-not-valid-for-use-in-specified-state-error/107b3ce5-d5fc-4583-bf4e-f64c598928ba?auth=1

I do also wonder if it could have something to do with the profile and user that is running the installer. Is it an administrator account? Could it be fairly locked down in regards to certificates and creation?
You also said you generated the key with no luck to import, does the file contents look like it should (or what you would expect it to look like)?

Warm Regards,
Vanessa

Hi Vanessa, user profiles is the same on other machines we successfully installed octopus on, so I am not sure (did try as local admin anyway for completeness and nothing changed). they are web front-end boxes an have had lock down on cryptography algorithms etc so this maybe the root cause, but unsure of what yet. I did confirm sha1 was still in use and available for the cert to gernerate. on that question, the cert did get created manually, but then the import statement returned the same error as the new-cert statement. the contents looked like it should! and thumbprint was created as well without error. I tried the crypto rename and kb uninstall with no change to the outcome. thanks Steve

Hi Steve,

Thank you for your reply. I’m sorry this is taking a bit of effort to fix. It looks like it is trying to read from an old configuration file from a failed installation with an incorrect thumbprint. Would you mind deleting everything from C:/Octopus folder, and try installing it again and tell us if it gives the exact same error or not?

Regards,

Kenny

Hello! I managed to successfully install Octopus Tentacles: A Reg key relating to the SHA1 crypto protocol was removed and the server rebooted. Thanks Steve

Hi Steve,

Good to hear! Let us know if you have any further questions at all.

Kind regards,

Kenny