OrchardCMS/OrchardCore · error · InvalidOperationException

Multiple certificates with the same thumbprint were found.

Error message

Multiple certificates with the same thumbprint were found.

What it means

OpenIdServerService.GetCertificate looks up a certificate in an X509 store by thumbprint with validOnly:false. The store find is expected to return at most one match; if more than one certificate with the same thumbprint is present, the switch's fallback arm throws InvalidOperationException('Multiple certificates with the same thumbprint were found.'), treating the store contents as corrupted.

Solutions

1. Open the certificate store (certmgr.msc / certlm.msc) and delete the duplicate certificates sharing that thumbprint, keeping one valid copy.
2. Re-import the certificate once from the original PFX/DER file into a single store location.
3. Verify the store name/location configured for the shell points to exactly one store so the find cannot see duplicates.
4. If corruption persists, recreate the certificate store contents or regenerate the encryption certificate via the OpenID settings.

// Before importing, check the store for existing thumbprint duplicates
using var store = new X509Store(StoreName.My, StoreLocation.LocalMachine);
store.Open(OpenFlags.ReadOnly);
var dupes = store.Certificates.Find(X509FindType.FindByThumbprint, thumbprint, validOnly: false);
if (dupes.Count > 0) throw new InvalidOperationException("Thumbprint already present; skip import.");

bool HasNoThumbprintDuplicates(string thumbprint, X509Store store) =>
    store.Certificates.Find(X509FindType.FindByThumbprint, thumbprint, validOnly: false).Count <= 1;

try
{
    var cert = openIdServerService.GetCertificate(thumbprint);
}
catch (InvalidOperationException ex) when (ex.Message.Contains("Multiple certificates"))
{
    logger.LogCritical(ex, "Duplicate certificate thumbprint {Thumbprint} in store — clean up the store.", thumbprint);
    throw;
}

When it happens

Trigger: The certificate store (configured for the shell's encryption/decryption certificate) contains duplicate entries sharing one thumbprint — typically after a store import, backup restore, or misconfigured store location (CurrentUser vs LocalMachine both populated).

Common situations: Certificate imported twice into the store; cluster nodes syncing stores; development copy of App_Data certificates re-imported into the Windows store; store path misconfiguration causing search across multiple locations.

Understand the failure class

Background: "This is a bug, please report it": internal invariant violations, unreachable panics, and SNH errors explained — this error's family across 47 libraries.

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• The application was concurrently updated and cannot be…
• The authorization was concurrently updated and cannot be…
• The scope was concurrently updated and cannot be persisted…
• The token was concurrently updated and cannot be persisted…
• An error occurred while pruning authorizations.

AI-assisted analysis of OrchardCMS/OrchardCore@4306c0717f (2026-09-13). Data as JSON: /api/errors/be64a24dde5a80d5. Report an issue: GitHub.

Appendix: source

Thrown at src/OrchardCore.Modules/OrchardCore.OpenId/Services/OpenIdServerService.cs:473

        if (exceptions != null)
        {
            throw new AggregateException(exceptions);
        }
    }

    private static X509Certificate2 GetCertificate(StoreLocation location, StoreName name, string thumbprint)
    {
        using var store = new X509Store(name, location);
        store.Open(OpenFlags.ReadOnly);

        var certificates = store.Certificates.Find(X509FindType.FindByThumbprint, thumbprint, validOnly: false);

        return certificates.Count switch
        {
            0 => null,
            1 => certificates[0],
            _ => throw new InvalidOperationException("Multiple certificates with the same thumbprint were found."),
        };
    }

    private static DirectoryInfo GetEncryptionCertificateDirectory(ShellOptions options, ShellSettings settings)
        => Directory.CreateDirectory(Path.Combine(
            options.ShellsApplicationDataPath,
            options.ShellsContainerName,
            settings.Name, "IdentityModel-Encryption-Certificates"));

    private static DirectoryInfo GetSigningCertificateDirectory(ShellOptions options, ShellSettings settings)
        => Directory.CreateDirectory(Path.Combine(
            options.ShellsApplicationDataPath,
            options.ShellsContainerName,
            settings.Name, "IdentityModel-Signing-Certificates"));

    private async Task<ImmutableArray<(string path, X509Certificate2 certificate)>> GetCertificatesAsync(DirectoryInfo directory)
    {
        if (!directory.Exists)

View on GitHub (pinned to 4306c0717f)