Internal.Cryptography.CryptoThrowHelper.WindowsCryptographicException

user_6398051 0
Viewed 17031

I'm getting the following error message from Visual Studio 2017 on first run of the ASP.NET Core MVC Boilerplate template (DotNet Core) regarding the SSL certificate:

"Internal.Cryptography.CryptoThrowHelper.WindowsCryptographicException occurred HResult=0x80070002 Message=The system cannot find the file specified Source=
StackTrace: at Internal.Cryptography.Pal.CertificatePal.FromBlobOrFile(Byte[] rawData, String fileName, String password, X509KeyStorageFlags keyStorageFlags) at System.Security.Cryptography.X509Certificates.X509Certificate..ctor(String fileName, String password, X509KeyStorageFlags keyStorageFlags) at Microsoft.AspNetCore.Hosting.KestrelServerOptionsHttpsExtensions.UseHttps(KestrelServerOptions options, String fileName, String password) ... "

All other projects using SSL work fine and I've double checked that my localhost certificate is in the Trusted Root Certification Authorities for my local machine and has not expired. The project is running IISExpress - perhaps it's not looking the correct place? I'm not sure. Any ideas where I'm going wrong?

iis-express .net-core ssl asp.net c#
5 Answers

If you're running in docker, another workaround is doing a copy at startup.

# The copy is done, because wildcard_certificate.pfx is put into the container using docker secrets, which makes it a symlink. 
# Reading a certificate as a symlink is not supported at this moment: https://stackoverflow.com/q/43955181/1608705
# After doing a copy, the copied version is not a symlink anymore.
ENTRYPOINT (IF EXIST "c:\certificates\wildcard_certificate.pfx" (copy c:\certificates\wildcard_certificate.pfx c:\app\wildcard_certificate.pfx)) && dotnet webapplication.dll

My application runs in the "c:\app" folder and I put my "to be copied" certificates in "c:\certificates". At startup the certificate is copied to "c:\app", which my environment variables point to.

version: "3.7"
services:
  webapplication:
    image: ({CONTAINER_REGISTRY})/webapplication:({LABEL})
    environment:
      - ASPNETCORE_URLS=https://+;http://+
      - ASPNETCORE_HTTPS_PORT=443
      - ASPNETCORE_Kestrel__Certificates__Default__Path=wildcard_certificate.pfx
    secrets:
      - source: config_secrets
        target: C:/app/appsettings.json
      - source: wildcard_certificate_pfx
        target: c:\certificates\wildcard_certificate.pfx
user_16087050

Context

I'm setting up a new dotnet 6 mvcapp website and trying to install Certbot generated certificate locally. The settings for kestrel to load certificate from file was simple enough but I keep getting above errors. Reason for that like someone has mentioned, the fullchain.pem is actually a symlink or in other word: a shortcut. Solution for that is to right click on the '.pem file' shortcut and select Open file location and then get the actual .pem files.

Updating your settings to point to the actual files and you should be ok.

Wrong path points to live folder

"Certificates": {
  "Default": {
    "Path": "C:\\Certbot\\live\\{my domain}\\fullchain.pem",
    "KeyPath": "C:\\Certbot\\live\\{my domain}\\privkey.pem"
  }
}

Correct path points to archive folder

"Certificates": {
  "Default": {
    "Path": "C:\\Certbot\\archive\\{my domain}\\fullchain.pem",
    "KeyPath": "C:\\Certbot\\archive\\{my domain}\\privkey.pem"
  }
}

enter image description here

user_41255340

I've just spent all morning fixing this error....

I'm using the Azure.Security.KeyVault.Certificates nuget package to download a certificate from a KeyVault and use it for IdentityServer.

I recently updated nuget packages for our project so refactored a bit of code, deleting the key bit of the jigsaw.

 var signingCertificate = certificateClient.DownloadCertificate(new DownloadCertificateOptions(signingCertificateName)
 {
      KeyStorageFlags = System.Security.Cryptography.X509Certificates.X509KeyStorageFlags.MachineKeySet,
 });

X509KeyStorageFlags.MachineKeySet is the secret sauce to getting it running on Azure. I tried several other options before landing back on this one. The annoying thing is, had this in originally before I started refactoring!

user_21077880
Related