X509Certificate Constructor Exception

c# .net x509certificate
lukiffer picture lukiffer · Mar 31, 2012 · Viewed 50.7k times · Source 
//cert is an EF Entity and 
//    cert.CertificatePKCS12 is a byte[] with the certificate.

var certificate = new X509Certificate(cert.CertificatePKCS12, "SomePassword");

When loading a certificate from our database, on our staging server (Windows 2008 R2/IIS7.5) we get this exception:

System.Security.Cryptography.CryptographicException: An internal error occurred.

   at System.Security.Cryptography.CryptographicException.ThrowCryptographicException(Int32 hr)
   at System.Security.Cryptography.X509Certificates.X509Utils._LoadCertFromBlob(Byte[] rawData, IntPtr password, UInt32 dwFlags, Boolean persistKeySet, SafeCertContextHandle& pCertCtx)
   at System.Security.Cryptography.X509Certificates.X509Certificate.LoadCertificateFromBlob(Byte[] rawData, Object password, X509KeyStorageFlags keyStorageFlags)

NOTE: This issue does not happen locally (Windows 7/Casini).

Any insight is greatly appreciated.

Answer

lukiffer picture lukiffer · Apr 6, 2012

Turns out there's a setting in the IIS Application Pool configuration (Application Pools > Advanced Settings) to load the user profile for the application pool identity user. When set to false, the key containers aren't accessible.

So just set Load User Profile option as True

App Pool-> Advanced Settings Screen

Related questions

What exactly happens when I set LoadUserProfile of IIS pool?

I faced the following issue. I run the following code var binaryData = File.ReadAllBytes(pathToPfxFile); var cert = new X509Certificate2(binaryData, password); in two processes. One of the processes runs under LOCAL_SYSTEM and there this code succeeds. Another one …

Read More
How to get X509Certificate from certificate store and generate xml signature data?

How can I get X509Certificate from certificate store and then generate XML SignatureData in .net C#?

Read More
Generate a self-signed certificate on the fly

I searched around, but I didn't find a clear example. I want to create a self-signed (self-)trusted certificate programmatically (C#), following these steps: STEP 1: Create a root CA certificate on the fly and add it to the certificate store …

Read More