I'm trying to deploy my web server on a Ubuntu 20.04 server. I am using ASP.NET Core it's Data Protection feature and provided it with a certificate to be able to encrypt the keys stored in the database like so:
var dataProtectionCertificate = new X509Certificate2(
configuration.GetValue<string>("Core:DataProtectionCertificatePath"),
configuration.GetValue<string>("Core:DataProtectionCertificatePassword"));
services.AddDataProtection()
.SetApplicationName(left out for security)
.PersistKeysToDbContext<ApplicationDbContext>()
.ProtectKeysWithCertificate(dataProtectionCertificate);
The certificate I've created is a PFX file made on this server using OpenSSL with the following commands:
- openssl genrsa -aes256 -out app_key.pem 2048
- openssl req -key app_key.pem -new -x509 -days 36500 -out app_cert.crt
- openssl pkcs12 -export -in app_cert.crt -inkey app_key.pem -out app_cert.pfx
I then provide this PFX certificate to my application along with a password.
On my own PC this is running just fine (Windows 10), but on the server (Ubuntu 20.04) this is throwing an exception:
root-nextlevel-auth-1 | warn: Microsoft.AspNetCore.DataProtection.KeyManagement.DefaultKeyResolver[12]
root-nextlevel-auth-1 | Key {5698643d-b0a7-4c77-b4f7-03c93ed2d78f} is ineligible to be the default key because its CreateEncryptor method failed.
root-nextlevel-auth-1 | System.Security.Cryptography.CryptographicException: Symmetric algorithm is not specified.
root-nextlevel-auth-1 | at System.Security.Cryptography.Xml.EncryptedXml.GetDecryptionKey(EncryptedData , String )
root-nextlevel-auth-1 | at System.Security.Cryptography.Xml.EncryptedXml.DecryptDocument()
root-nextlevel-auth-1 | at Microsoft.AspNetCore.DataProtection.XmlEncryption.EncryptedXmlDecryptor.Decrypt(XElement encryptedElement)
root-nextlevel-auth-1 | at Microsoft.AspNetCore.DataProtection.XmlEncryption.XmlEncryptionExtensions.DecryptElement(XElement element, IActivator activator)
root-nextlevel-auth-1 | at Microsoft.AspNetCore.DataProtection.KeyManagement.XmlKeyManager.Microsoft.AspNetCore.DataProtection.KeyManagement.Internal.IInternalXmlKeyManager.DeserializeDescriptorFromKeyElement(XElement keyElement)
root-nextlevel-auth-1 | at Microsoft.AspNetCore.DataProtection.KeyManagement.DeferredKey.<>c__DisplayClass1_0.<GetLazyDescriptorDelegate>b__0()
root-nextlevel-auth-1 | at System.Lazy`1.ViaFactory(LazyThreadSafetyMode )
root-nextlevel-auth-1 | at System.Lazy`1.ExecutionAndPublication(LazyHelper , Boolean )
root-nextlevel-auth-1 | at System.Lazy`1.CreateValue()
root-nextlevel-auth-1 | at System.Lazy`1.get_Value()
root-nextlevel-auth-1 | at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyBase.get_Descriptor()
root-nextlevel-auth-1 | at Microsoft.AspNetCore.DataProtection.AuthenticatedEncryption.CngGcmAuthenticatedEncryptorFactory.CreateEncryptorInstance(IKey key)
root-nextlevel-auth-1 | at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyBase.CreateEncryptor()
root-nextlevel-auth-1 | at Microsoft.AspNetCore.DataProtection.KeyManagement.DefaultKeyResolver.CanCreateAuthenticatedEncryptor(IKey key)
I'm not super familiar with the in depths of ceritificates and encryption algorithms so if someone knows what could be causing this that would be appreciated.
Edit: Here is the XML key in question:
<key id="661223d7-f355-41c7-944a-37cdd88f556b" version="1">
<creationDate>2022-09-19T20:44:16.1017041Z</creationDate>
<activationDate>2022-09-19T20:44:09.7790984Z</activationDate>
<expirationDate>2022-12-18T20:44:09.7790984Z</expirationDate>
<descriptor deserializerType="Microsoft.AspNetCore.DataProtection.AuthenticatedEncryption.ConfigurationModel.AuthenticatedEncryptorDescriptorDeserializer, Microsoft.AspNetCore.DataProtection, Version=6.0.0.0, Culture=neutral, PublicKeyToken=adb9793829ddae60">
<descriptor>
<encryption algorithm="AES_256_CBC" />
<validation algorithm="HMACSHA256" />
<encryptedSecret decryptorType="Microsoft.AspNetCore.DataProtection.XmlEncryption.EncryptedXmlDecryptor, Microsoft.AspNetCore.DataProtection, Version=6.0.0.0, Culture=neutral, PublicKeyToken=adb9793829ddae60"
xmlns="http://schemas.asp.net/2015/03/dataProtection">
<EncryptedData Type="http://www.w3.org/2001/04/xmlenc#Element"
xmlns="http://www.w3.org/2001/04/xmlenc#">
<EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc" />
<KeyInfo
xmlns="http://www.w3.org/2000/09/xmldsig#">
<EncryptedKey
xmlns="http://www.w3.org/2001/04/xmlenc#">
<EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5" />
<KeyInfo
xmlns="http://www.w3.org/2000/09/xmldsig#">
<X509Data>
<X509Certificate>hidden</X509Certificate>
</X509Data>
</KeyInfo>
<CipherData>
<CipherValue>hidden</CipherValue>
</CipherData>
</EncryptedKey>
</KeyInfo>
<CipherData>
<CipherValue>hidden</CipherValue>
</CipherData>
</EncryptedData>
</encryptedSecret>
</descriptor>
</descriptor>
</key>