{"record":{"id":"be64a24dde5a80d5","repo":"OrchardCMS/OrchardCore","slug":"multiple-certificates-with-the-same-thumbprint-were-found","errorCode":null,"errorMessage":"Multiple certificates with the same thumbprint were found.","messagePattern":"Multiple certificates with the same thumbprint were found\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/OrchardCore.Modules/OrchardCore.OpenId/Services/OpenIdServerService.cs","lineNumber":473,"sourceCode":"\n        if (exceptions != null)\n        {\n            throw new AggregateException(exceptions);\n        }\n    }\n\n    private static X509Certificate2 GetCertificate(StoreLocation location, StoreName name, string thumbprint)\n    {\n        using var store = new X509Store(name, location);\n        store.Open(OpenFlags.ReadOnly);\n\n        var certificates = store.Certificates.Find(X509FindType.FindByThumbprint, thumbprint, validOnly: false);\n\n        return certificates.Count switch\n        {\n            0 => null,\n            1 => certificates[0],\n            _ => throw new InvalidOperationException(\"Multiple certificates with the same thumbprint were found.\"),\n        };\n    }\n\n    private static DirectoryInfo GetEncryptionCertificateDirectory(ShellOptions options, ShellSettings settings)\n        => Directory.CreateDirectory(Path.Combine(\n            options.ShellsApplicationDataPath,\n            options.ShellsContainerName,\n            settings.Name, \"IdentityModel-Encryption-Certificates\"));\n\n    private static DirectoryInfo GetSigningCertificateDirectory(ShellOptions options, ShellSettings settings)\n        => Directory.CreateDirectory(Path.Combine(\n            options.ShellsApplicationDataPath,\n            options.ShellsContainerName,\n            settings.Name, \"IdentityModel-Signing-Certificates\"));\n\n    private async Task<ImmutableArray<(string path, X509Certificate2 certificate)>> GetCertificatesAsync(DirectoryInfo directory)\n    {\n        if (!directory.Exists)","sourceCodeStart":455,"sourceCodeEnd":491,"githubUrl":"https://github.com/OrchardCMS/OrchardCore/blob/4306c0717fe573f6fca1b4955909ddab6a192807/src/OrchardCore.Modules/OrchardCore.OpenId/Services/OpenIdServerService.cs#L455-L491","documentation":"OpenIdServerService.GetCertificate looks up a certificate in an X509 store by thumbprint with validOnly:false. The store find is expected to return at most one match; if more than one certificate with the same thumbprint is present, the switch's fallback arm throws InvalidOperationException('Multiple certificates with the same thumbprint were found.'), treating the store contents as corrupted.","triggerScenarios":"The certificate store (configured for the shell's encryption/decryption certificate) contains duplicate entries sharing one thumbprint — typically after a store import, backup restore, or misconfigured store location (CurrentUser vs LocalMachine both populated).","commonSituations":"Certificate imported twice into the store; cluster nodes syncing stores; development copy of App_Data certificates re-imported into the Windows store; store path misconfiguration causing search across multiple locations.","solutions":["Open the certificate store (certmgr.msc / certlm.msc) and delete the duplicate certificates sharing that thumbprint, keeping one valid copy.","Re-import the certificate once from the original PFX/DER file into a single store location.","Verify the store name/location configured for the shell points to exactly one store so the find cannot see duplicates.","If corruption persists, recreate the certificate store contents or regenerate the encryption certificate via the OpenID settings."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Before importing, check the store for existing thumbprint duplicates\nusing var store = new X509Store(StoreName.My, StoreLocation.LocalMachine);\nstore.Open(OpenFlags.ReadOnly);\nvar dupes = store.Certificates.Find(X509FindType.FindByThumbprint, thumbprint, validOnly: false);\nif (dupes.Count > 0) throw new InvalidOperationException(\"Thumbprint already present; skip import.\");","typeGuard":"bool HasNoThumbprintDuplicates(string thumbprint, X509Store store) =>\n    store.Certificates.Find(X509FindType.FindByThumbprint, thumbprint, validOnly: false).Count <= 1;","tryCatchPattern":"try\n{\n    var cert = openIdServerService.GetCertificate(thumbprint);\n}\ncatch (InvalidOperationException ex) when (ex.Message.Contains(\"Multiple certificates\"))\n{\n    logger.LogCritical(ex, \"Duplicate certificate thumbprint {Thumbprint} in store — clean up the store.\", thumbprint);\n    throw;\n}","preventionTips":["Import certificates exactly once; script imports idempotently (check-before-insert).","Pick one store location (CurrentUser or LocalMachine) and stick to it.","Audit certificate stores after backups/restores and cluster syncs."],"tags":["x509","certificate","openid","store","thumbprint"],"backgroundTag":"internal-invariant-violation","analyzedSha":"4306c0717fe573f6fca1b4955909ddab6a192807","analyzedAt":"2026-09-13T17:41:05.024Z","contentChangedAt":"2026-09-13T17:41:05.024Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}