WindowsCryptographicException running ASP.NET Core 2 web app in Azure Web App Service

Question

I am trying to host a ASP.NET Core 2 web application using Azure's Web App Service. The web app runs fine on my development machine (Windows 10). It also works on a Ubuntu 17.10 virtual machine when I publish the files. However, when I publish the web app from Visual Studio to Azure I get the following error message:

WindowsCryptographicException: The system cannot find the file specified
    System.Security.Cryptography.CngKey.Open(string keyName, CngProvider provider, CngKeyOpenOptions openOptions)
    System.Security.Cryptography.CngKey.Open(string keyName, CngProvider provider)
    Internal.Cryptography.Pal.CertificatePal.GetPrivateKey<T>(Func<CspParameters, T> createCsp, Func<CngKey, T> createCng)
    Internal.Cryptography.Pal.CertificatePal.GetRSAPrivateKey()
    Internal.Cryptography.Pal.CertificateExtensionsCommon.GetPrivateKey<T>(X509Certificate2 certificate, Predicate<X509Certificate2> matchesConstraints)
    ...
    Microsoft.AspNetCore.Hosting.ConventionBasedStartup.Configure(IApplicationBuilder app)
    Microsoft.AspNetCore.Server.IISIntegration.IISSetupFilter+<>c__DisplayClass3_0.<Configure>b__0(IApplicationBuilder app)
    Microsoft.AspNetCore.Hosting.Internal.AutoRequestServicesStartupFilter+<>c__DisplayClass0_0.<Configure>b__0(IApplicationBuilder builder)
    Microsoft.AspNetCore.Hosting.Internal.WebHost.BuildApplication()
.NET Core 4.6.26212.01 X86 v4.0.0.0    |   Microsoft.AspNetCore.Hosting version 2.0.2-rtm-10011    |    Microsoft Windows 10.0.14393

I am storing a key file in the project directory and attempting to create credentials from it.

After searching, I have found the following sites that point to similar solutions: https://github.com/dotnet/corefx/issues/11042, https://github.com/IdentityServer/IdentityServer4/issues/1432, Certificate not found when deploying IdentityServer 4 to Azure VM, and CryptographicException was unhandled: System cannot find the specified file

These suggest that I need to modify the settings of the Application Pool and set the "Load User Profile" to true and properly set the permissions of the file. However, I am unsure of how to do this using the Azure Portal.

In addition, instead of modifying a file on the server, is there a solution where code can be added to either Program.cs or Startup.cs (excerpts given below)?

Program.cs (referenced link)

public class Program
{
    public static void Main(string[] args)
    {
        BuildWebHost(args).Run();
    }

    public static IWebHost BuildWebHost(string[] args) =>
        WebHost.CreateDefaultBuilder(args)
            .UseKestrel()
            .UseContentRoot(Directory.GetCurrentDirectory())
            .UseSetting("detailedErrors", "true")
            .UseIISIntegration()
            .UseStartup<Startup>()
            .CaptureStartupErrors(true)
            .Build();
}

Startup.cs

public class Startup
{
    public Startup(IConfiguration configuration)
    {
        Configuration = configuration;
    }

    public IConfiguration Configuration { get; }

    // This method gets called by the runtime. Use this method to add services to the container.
    public void ConfigureServices(IServiceCollection services)
    {   
        services.AddMvc();
    }

    // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
    public void Configure(IApplicationBuilder app, IHostingEnvironment env)
    {
        if (env.IsDevelopment())
        {
            app.UseBrowserLink();
            app.UseDeveloperExceptionPage();
        }
        else
        {
            app.UseExceptionHandler("/Error");
        }
        app.UseStaticFiles();
        app.UseMvc();
    }
}

Thanks in advance.

Update #1

The app deploys properly. I just encounter the error when the following code is executed.

private static RSA GetPrivateKey(byte[] p12) {
    var certificate = new X509Certificate2(p12, "notasecret", X509KeyStorageFlags.MachineKeySet | X509KeyStorageFlags.Exportable);
    var rsa = certificate.GetRSAPrivateKey();
    return rsa;
}

Here is my project .csproj file:

<Project Sdk="Microsoft.NET.Sdk.Web">
    <PropertyGroup>
        <TargetFramework>netcoreapp2.0</TargetFramework>
    </PropertyGroup>
    <ItemGroup>
        <PackageReference Include="GDataDB" Version="1.0.0" />
        <PackageReference Include="Microsoft.AspNetCore.All" Version="2.0.8" />
        <PackageReference Include="Microsoft.VisualStudio.Web.CodeGeneration.Design" Version="2.0.3" />
    </ItemGroup>
    <ItemGroup>
        <DotNetCliToolReference Include="Microsoft.VisualStudio.Web.CodeGeneration.Tools" Version="2.0.3" />
    </ItemGroup>
    <ItemGroup>
        <Folder Include="Pages\" />
        <Folder Include="Properties\PublishProfiles\" />
    </ItemGroup>
    <ItemGroup>
        <None Update="total-method-203123-88f147135d99.p12">
            <CopyToOutputDirectory>Always</CopyToOutputDirectory>
        </None>
    </ItemGroup>
</Project>

Udpate #2

Here is a minimal repo that demonstrates the error: https://github.com/jonliew/testdatawebapp

I first publish the GDataDB to a nuget package using the FolderProfile in Visual Studio. Then, I add the package to the DataWebApp project. Finally, I publish the DataWebApp and get the above behavior.

Answer 1

Most likely, the issue is that you are targeting .NET Core 2.0.8, which is not yet fully deployed on App Service. See here for the announcement.

To verify whether this is indeed the problem, please try deploying to a test Web App in the West US 2 region (not West US), which does have the release. You should not get the error there.