Knowledge Base

How to troubleshoot the IIS HTTPS binding error “A specified logon session does not exist”

Updated on July 13, 2026

Overview

By the end of this article, you will be able to diagnose and resolve the Internet Information Services (IIS) HTTPS binding error “A specified logon session does not exist. It may already have been terminated.” — reported as a Windows result code (HRESULT) of 0x80070520 — so that HTTPS bindings save successfully. The article covers the symptoms that identify the error, its common causes, step-by-step resolution, the underlying root cause, and prevention tips. The resolution uses the Microsoft Management Console (MMC) certificate snap-in and the Personal Information Exchange (PFX) certificate format to repair the link between a certificate and its private key.

Who this is for and when it applies

This article is for system administrators, IT support engineers, and DevOps engineers who manage HTTPS bindings on Windows servers running Internet Information Services (IIS). It applies when SSL/TLS certificates are installed for HTTPS and involves certificate store configuration, private key permissions, and IIS binding settings.

Symptoms

You are likely seeing this problem if the following are true. When you add or edit an HTTPS binding in Internet Information Services (IIS), the binding fails and IIS displays this error:

There was an error while performing this operation.

Details: A specified logon session does not exist. It may already have been terminated. (Exception from HRESULT: 0x80070520)

Other indicators include:

The HTTPS binding fails when you try to add or save it in IIS.

Manage Private Keys option is missing in the Microsoft Management Console (MMC) certificate snap-in, which usually means the private key is not present.

The certificate appears valid and shows a private key, but the binding still fails.

Causes

The IIS HTTPS binding error “A specified logon session does not exist” is usually caused by one of the following:

The certificate was imported incorrectly, so it is missing its private key or was placed in the wrong certificate context.

The private key association is corrupted in the Windows certificate store.

The binding is set to a specific IP address instead of All Unassigned.

Figure 1: Common causes of the IIS HTTPS binding error

Resolution

Follow these steps in order to repair the certificate's private key association and restore the HTTPS binding in Internet Information Services (IIS).

Verify the private key. Open the Microsoft Management Console (MMC) certificate snap-in and confirm the certificate shows the message “You have a private key that corresponds to this certificate.”

Check the private key permissions. In MMC, right-click the certificate and select All Tasks > Manage Private Keys, then:

Confirm that Read access is granted to the required accounts, such as IIS_IUSRS and NETWORK SERVICE.

Compare these permissions against a certificate that already works correctly to make sure they match.

Repair the certificate association. Export the certificate as a Personal Information Exchange (PFX) file with the private key included, then re-import it into the Local Computer > Personal certificate store.

Rebind in IIS. Update the existing HTTPS binding, run iisreset to restart IIS, and then add the HTTPS binding again using the repaired certificate.

Root cause

This error occurs because Windows cannot establish the logon session needed to access the certificate's private key. Re-importing the certificate as a Personal Information Exchange (PFX) file into the Local Computer certificate store rebuilds the correct mapping between the certificate and its private key container, which allows the HTTPS binding in Internet Information Services (IIS) to succeed.

Prevention

To avoid this IIS HTTPS binding error in the future:

Always export and import certificates as Personal Information Exchange (PFX) files with the private key included.

Store certificates in the Local Computer > Personal certificate store.

Avoid binding to a specific IP address unless required; use All Unassigned where possible.

Make sure the IIS worker process accounts have Read permission on the certificate's private key.

Verify the fix

To confirm the error is resolved, add or edit the HTTPS binding in Internet Information Services (IIS) and save it. The binding should save without the “A specified logon session does not exist” error, and the site should respond over HTTPS. In one confirmed case, exporting the certificate with its private key from the Microsoft Management Console (MMC) and re-importing it into the same certificate store resolved the error.