I am trying to learn securing wcf service using ssl. I found this website and I am following the steps. http://robbincremers.me/2011/12/27/wcf-transport-security-and-client-certificate-authentication-with-self-signed-certificates/. But when came to creating certificate step I had an issue. Using below to create a certificate.

makecert –pe –n “CN=localhost” –sr localmachine –ss my –sky exchange

By default, the makecert utility creates certificates whose root authority is "Root Agency". For some reason, my Root Agency cert has become corrupted (invalid digital signature). How can I restore a valid Root Agency cert?

The site says when I create a certificate using above statement and double click on it I should see this

enter image description here

But I am seeing this:

enter image description here

So even If I add Root Agency to trusted root certificate authority it doesn't make any sense.

Other screenshot from my guide site: enter image description here

And I have

enter image description here

How can I fix "This certificate has an invalid digital signature" issue?

2 Answers 2


This could be due to the length restrictions on certificate keys.

Microsoft enforced a minimum key length limit of 1024 bits in August 2012. Check that your self signed cert is created with a key length of at least 1024 bits.

For more info you can check out this blog post What does the “This certificate has an invalid digital signature.” message actually mean?

You can specify the key length when creating the cert with by using the -len parameter like so:

makecert -pe -ss MY -$ individual -n "CN=your name here" -len 2048 -r
  • Exactly this reason with Windows 10 and Openssl.
    – Vesnog
    Jul 30, 2018 at 20:04
  • I have the same issue with trusted root and parent CA, but with a public key "RSA (2048 Bits)"...is there a new restriction added recently that forces greater key lenghts? May 23, 2023 at 6:07
  • It's difficult to say for certain from the information you have provided but I don't see any explicit mention that the key size requirement is greater that 2048 for CA Roots (at least according to most recent CAB Forum baseline requirements). I did see that the requirement for Code Signing certs is been upped to >= 3072 bits somewhere in 2021. Does your certificate perhaps have the Code signing extension enabled? Anyway, this is not a Q&A section - perhaps consider making this a separate question if you need more answers.
    – ilikebeets
    May 24, 2023 at 12:42

you can run following command in a command prompt (with administrative rights):

certutil -setreg chain\minRSAPubKeyBitLength 512

this will set back the required key length (less secure!)

see https://morgansimonsen.wordpress.com/2013/05/30/what-does-the-this-certificate-has-an-invalid-digital-signature-message-actually-mean/ for more information.

quote from this website:

The reason is to be found in the Public Key Length field. In this certificate the public key is only 512 bytes. In August of 2012 Microsoft released an update that will block any certificates with RSA keys less than 1024 bits in length. This was done to make sure that a private key cannot be discovered using brute force methods and thus exposing private information. After the update the CryptoAPI, which builds a certificate trust chain and validates that chain by using time validity, certificate revocation, and certificate policies (such as intended purposes), implements an additional check to make sure that no certificate in the chain has an RSA key length of less than 1024 bits. Any such certificates will not be trusted. Actually the error displayed by Internet Explorer; “The security certificate presented by this web site is not secure” makes more sense than the messages in the certificate properties (“This certificate has an invalid digital signature”). Because that is actually what is happening; the certificate is not good enough to protect whatever data your are transmitting between the client and the server. So how come, according to the CryptoAPI extension, the digital signature is not valid? In public key cryptography the private key is generated from the public keys, or rather, the very large prime numbers selected to be the public key. That means that if the public key is weak, i.e. less than 512 bytes, the resulting private key would be as well. Since it is the issuing authority’s private key that is used to sign the issued certificate the signature itself would also be weak. And that is why the CryptoAPI displays the message “This certificate has an invalid digital signature”. What it should have displayed is something along the lines of “this certificates was signed with a weak private key etc.”. If you are desperate to use certificates with key lengths less than 1024 bits you can override the restrictions imposed by the Microsoft update. How to do that is documented in the KB article accompanying the update. Here is the command I ran to test that I was on the right track and force IE to let me use the certificate.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .