Toolkit troubleshooting

Windows protected your PCCopy Anchor Link

SmartScreen shows Windows protected your PC for a downloaded program that has not yet built up reputation - this happens for every new release for a while, signed or not.

1. Check the file first: Verify the download.
2. Choose More info, then Run anyway.

If the file was blocked as downloaded from the internet, you can also clear that mark: right-click the file, Properties, tick Unblock, OK - or Unblock-File .\aethercert-toolkit-windows-amd64-en-US.msi in PowerShell.

The window stays blank or the app does not startCopy Anchor Link

The app draws its window with the Microsoft Edge WebView2 runtime. Windows 11 has it; on Windows Server 2019 and 2022 setup installs it - the normal installer downloads it from Microsoft while it runs, so on a server without internet access it cannot. Use the offline installer there: it carries the runtime and installs it without a connection.

msiexec /i aethercert-toolkit-windows-amd64-offline-en-US.msi

The Computer tab is read-onlyCopy Anchor Link

Importing, deleting and exporting private keys in the computer store need administrator rights. Choose Restart as administrator in the banner on the Computer tab and confirm the UAC prompt. Creating a key in This computer's key store in Create CSR needs the same.

"No matching key from Create CSR found"Copy Anchor Link

The toolkit matches an issued certificate to its key by the public key. It finds no key when:

• the CSR was created somewhere else (IIS, certreq, OpenSSL, another computer) - choose the .key file yourself, or import on the computer that holds the key;
• the key existed only in memory and the app was closed before it was saved - the key is gone, and the certificate has to be requested again with a new CSR;
• the key file was moved or deleted after it was saved - choose it at its new location;
• the CA issued the certificate for a different request than you think - compare the key pin in Check CSR with the certificate's.

Export offers no .pfx or .keyCopy Anchor Link

The certificate's private key is marked as not exportable, lives on a smart card or HSM, or the certificate has no private key on this computer. Only the certificate formats are available then. For a computer certificate, restart as administrator - reading its key needs administrator rights.

A key created in the Windows key store without Allow exporting the private key later can never be exported; Windows fixes that at creation.

Windows Server 2016 cannot import the PFXCopy Anchor Link

Windows Server 2016 and older cannot read a PFX encrypted with AES-256. Export or convert it again with Compatible with Windows Server 2016 and older (3DES instead of AES-256), or --legacy on the command line.

Sign code finds no certificateCopy Anchor Link

The list shows only certificates with the Code Signing purpose and a private key; expired ones are listed but cannot be selected. Import a code signing PFX under Certificates, plug in the USB token and install its driver - or choose PFX file. Refresh the list after plugging in a token.

"Signed · root not trusted"Copy Anchor Link

The signature is intact, but this computer does not trust the root of the signing certificate. This is normal for an internal CA that is not deployed on this machine. On the computers that should run the file, deploy the root (and for self-signed certificates, the certificate itself into Trusted Publishers), usually by group policy.

The scanner finds nothingCopy Anchor Link

• Check the ports: the Common TLS preset covers the usual ones.
• A firewall between you and the targets drops the probes - run the toolkit inside that network.
• Turn on List open ports without TLS under Options to see what is open at all.
• Host names that do not resolve are listed as Could not resolve.

Internal certificates show as untrustedCopy Anchor Link

Trust is checked against the Mozilla roots, the Windows certificate store and an optional PEM file. If your internal CA is not in this computer's root store, add its root under Settings > Trusted certificate authorities > Additional roots (PEM file), or pass --ca-file to actk. Check that Trust this computer's root store is on.

A security scan result says "unknown"Copy Anchor Link

The probe for that protocol version did not finish - usually a firewall or an IPS that interrupts unusual handshakes. Run the scan again; if it persists, check the device in between. Unknown results cost no points.