未处理 CryptograpicException: 系统无法找到指定的文件

我试图拥抱 SSL 通信的奥秘，并找到了一个很好的 这个网站教程。我想测试我自己的证书。使用 VisualStudio2012，我只需添加一个现有文件(在。然后更改 app.config 中的“证书”和“密码”设置。然而，在尝试运行它时，我得到了一个错误:

未处理 CryptograpicException: 系统无法找到指定的文件

然后，我在我的 Web 服务中尝试了同样的方法，在那里我得到了关于这个错误的更多细节:

System.Security.Cryptography.CryptographicException: System cannot find specified file.


at System.Security.Cryptography.CryptographicException.ThrowCryptogaphicException(Int32 hr)
at System.Security.Cryptography.X509Certificates.X509Utils._QueryCertFileType(String fileName)
at System.Security.Cryptography.X509Certificates.X509Certificate.LoadCertificateFromFile(String fileName, Object password, X509KeyStorageFlags keyStorageFlags)
v System.Security.Cryptography.X509Certificates.X509Certificate2..ctor(String fileName, String password)
v TestServer.DataService.LoadSoap() v c:\Users\Administrator\Documents\Visual Studio 2012\Projects\TestServer\TestServer\DataService.asmx.cs:line 48

我已经把这个问题写给了这篇文章的作者，但是由于他最后一次回答是在2012年3月，我不确定他是否会回答。如果有人能帮我解决这个问题，我将非常感激。

附注: 当从。Cer to.Pfx，我已经更改了导出文件的标题。虽然我怀疑它对这个问题的影响，但我还是想提一下。

71870 次浏览
小开
最佳答案

Did you set the following on the application pool in IIS?

  1. Go to IIS Manager
  2. Go to the application pool instance
  3. Click advanced settings
  4. Under Process model, set Load User Profile to true

See this stack question for further reading: What exactly happens when I set LoadUserProfile of IIS pool?

小开

Because this question has a high search ranking I would like to present a way to present X509Certificate2 with an absolute path (which it only accepts) to a relatively located pxf key file in an ASP.net application.

    string path = HttpContext.Current.Server.MapPath("~") + "..\keys\relative_key.pfx";


X509Certificate2 cert = new X509Certificate2(path, "", X509KeyStorageFlags.DefaultKeySet);
小开

By passing CspParameters with flag csdMachineKeyKeyStore IIS can bypass the restriction that throws the Exception.

CspParameters cspParams = new CspParameters();
cspParams.KeyContainerName = Guid.NewGuid().ToString().ToUpperInvariant();
cspParams.Flags = CspProviderFlags.UseMachineKeyStore;
RSACryptoServiceProvider RSA = new RSACryptoServiceProvider(cspParams);

I found the solution here.

小开

For those of you who received the Cryptographic Exception when attempting to import a X509Certificate2 using the Import method, I found that using the Enum option for MachineKeySet bypassed the need for creating a userContext in IIS, and thus easier to implement.

X509Certificate2 cert = new X509Certificate2();
cert.Import(certificateFilePath, certPasshrase,
X509KeyStorageFlags.PersistKeySet | X509KeyStorageFlags.MachineKeySet);
小开

You need to specify absolute path instead of relative path.

AppDomain.CurrentDomain.BaseDirectory +"/Certificate/cer.PFX"
小开

For those who are trying to access the certificate from the Windows certificate store (Certificates (Local Computer)), be sure to given the application pool user access to the certificate's private key using Action -> All Tasks -> Manage Private Keys... Not doing that turned out to be the cause of me getting this error.


提交答案