How to fix "WinRM cannot make the configuration change because the Issuer used for the certificate mapping operation is not valid."

Description

This error occurs when you try to configure Windows Remote Management (WinRM) to use HTTPS authentication, but the system rejects the Certificate Authority (CA) that issued the certificate.

When you create a WinRM HTTPS listener, Windows validates the digital certificate. If the certificate is self-signed, issued by an untrusted source, or if the local computer cannot verify the certificate chain up to a Trusted Root Certification Authority, WinRM will block the configuration change to prevent security vulnerabilities.

Step-by-Step Fix

Step 1: Verify the Certificate Thumbprint

You need the exact thumbprint of the certificate you want to use.

1. Click the Start menu, type powershell, right-click it, and select Run as administrator.
2. Type the following command and press Enter:

   Get-ChildItem Cert:\LocalMachine\My

3. Locate your certificate in the list and copy its Thumbprint (a long string of numbers and letters).

Step 2: Install the Certificate into the Trusted Root Store

If the certificate is self-signed, Windows must explicitly trust it.

1. Press Windows Key + R, type mmc, and press Enter to open the Management Console.
2. Click File in the top menu, then select Add/Remove Snap-in.
3. Select Certificates from the left list and click Add.
4. Choose Computer account, click Next, select Local computer, and click Finish.
5. Click OK to close the snap-in window.
6. In the left pane, expand Certificates (Local Computer).
7. Expand Personal, then click Certificates.
8. Right-click your WinRM certificate, select All Tasks, and click Export. Follow the wizard to save it as a .cer file on your desktop (do not export the private key).
9. In the left pane, right-click Trusted Root Certification Authorities, select All Tasks, and click Import.
10. Follow the wizard to import the .cer file you just saved on your desktop.

Step 3: Delete Existing Broken Listeners

Clear any failed WinRM HTTPS configurations before creating a new one.

1. Go back to your Administrator PowerShell window.
2. Type the following command to check for existing listeners:

   winrm enumerate winrm/config/listener

3. If an HTTPS listener already exists and is broken, delete it by typing:

   winrm delete winrm/config/Listener?Address=*+Transport=HTTPS

Step 4: Recreate the WinRM HTTPS Listener

Manually link the trusted certificate to WinRM using the thumbprint from Step 1.

1. In the Administrator PowerShell window, type the following command (replace YOUR THUMBPRINT HERE with the actual thumbprint you copied):

   New-Item -Path WSMan:\LocalHost\Listener -Transport HTTPS -Address * -CertificateThumbprint "YOUR THUMBPRINT HERE"

2. Press Enter. The configuration change should now complete successfully without the issuer error.

Alternative Quick Fix (For Self-Signed Certificates)

If you just need a quick setup for testing purposes, you can let WinRM create and auto-trust its own certificate.

1. Open Administrator PowerShell.
2. Run this single command:

   Enable-PSRemoting -Force

3. Run this command to automatically generate a valid self-signed test certificate and link it to HTTPS:

   New-WinRMListener -Protocol HTTPS