Assume the following scenario:
- A web server certificate was generated using an ML-DSA-based key pair.
- We would like to integrate this with Internet Information Services (IIS).
- The configuration fails with the following error message:
There was an error while performing this operation.
Details:
A specified logon session does not exist. It may already have been terminated. (Exception from HRESULT: 0x80070520)
The same error occurs when setting the certificate binding using netsh as well.
Example:
netsh http add sslcert ^
ipport=0.0.0.0:443 ^
certhash=fa9e05fcede4a2c8c4658227ffec2c267eb0c2fc ^
appid={4dc3e181-e14b-4a21-b022-59fc669b0914}
This error message usually occurs when there is a problem with a certificate's private key, such as when the user does not have permission to use it or the key is unreadable.
In our case, however, this can be ruled out:
certutil -verifystore my fa9e05fcede4a2c8c4658227ffec2c267eb0c2fc
Cause
Apparently, the underlying technology stack (http.sys) is not yet able to handle certificates that use ML-DSA (although Microsoft lists TLS as a supported use case).
The problem has not yet been resolved.
Related links:
External sources
- What is ML-DSA support in AD CS? – Windows Server | Microsoft Learn
- Introduction to IIS Architectures | Microsoft Learn
- Microsoft AD CS Adds Support for Post-Quantum Cryptography with ML-DSA | Richard M. Hicks Consulting, Inc.
- IIS: A specified logon session does not exist – The Windows Guru – Walter's IT Blog
- How to Troubleshoot the IIS HTTPS Binding Error “A Specified Logon Session Does Not Exist” | Sectigo® Official
English 
Deutsch 
Français