X509Certificate2 Error - System cannot find the file specified

Question

The associated code, works well in an independent console application, whereas errors out, while trying to make it work, within an NSB architecture. I have tried to test the same within the worker, and also independently within a test console app. In either case, it errors out in the line - X509Certificate2 certificate = new X509Certificate2(filePath, "***key***UeUHFxS"); The exception message being - System.Security.Cryptography.CryptographicException: 'The system cannot find the file specified. The code consists of the one as shown and also an associated helper file for the Activate device. The exception is however, in the section for initializing the X509Certificate2, from the pfx file path and key.

class Program
{
    static void Main(string[] args)
    {
        try
        {
            string filePath = Path.GetDirectoryName(System.AppDomain.CurrentDomain.BaseDirectory);
            filePath = Directory.GetParent(Directory.GetParent(filePath).FullName).FullName;
            filePath = Path.Combine(filePath, @"Cert\TestCompany-qa.partner.client.siriusxm.com.pfx");

            X509Certificate2 certificate = new X509Certificate2(filePath, "****key****");
            SoapMessageHelper soapHelper = new SoapMessageHelper(certificate, @"https://api-ext-test.siriusxm.com/SAT/UpdateDeviceSatRefresh/v_1");
            var test = soapHelper.ActivateDevice(new ActivateDeviceRequest()
            {
                SourceName = "12493",
                ESN = "W26890HW",
                TimeStamp = DateTime.UtcNow,
                TrasanctionId = System.Guid.NewGuid().ToString()
            });

            XmlDocument doc = new XmlDocument();
            doc.LoadXml(test);

            foreach (XmlNode node in doc.DocumentElement.ChildNodes)
            {
                foreach (XmlNode locNode in node)
                {
                    if (locNode.Name == "ns0:responseRefreshDevice")
                    {
                        string resultCode = locNode["ns0:resultCode"].InnerText;
                        string errorCode = locNode["ns0:errorCode"].InnerText;
                        string errorMessage = locNode["ns0:errorMessage"].InnerText;
                        Console.WriteLine(resultCode + errorCode + errorMessage);
                    }
                }
            }

        }
        catch (Exception ex)
        {
            Console.WriteLine(
                String.Format("Exception occurred{0}Message:{1}{2}Inner Exception: {3}", Environment.NewLine, ex.Message, Environment.NewLine, ex.InnerException));
        }

    }

}

Answer 1

Let's try to modify your constructor to:

X509Certificate2 certificate = new X509Certificate2(filePath, key, 
                               X509KeyStorageFlags.MachineKeySet
                             | X509KeyStorageFlags.PersistKeySet
                             | X509KeyStorageFlags.Exportable);

Using MachineKeySet as msdn said that:

"Private keys are stored in the local computer store rather than the current user store. "

Answer 2

Providing an Absolute path, rather than a Relative path did help. The intention of providing a relative path was to include the certificate as part of the artifacts, and when the application gets deployed to the server, the certificate would get written to the output path, and get read from the location. However, while trying to test the working code, and currently, I find that only the absolute path is working, although the certificate property is set to copy always. The working code now looks like this :

filePath = @"C:\Users\<user name>\Documents\TestCompany-qa.partner.client.siriusxm.com.pfx"; 

X509Certificate2 certificate = new X509Certificate2(filePath, "****key****"); 

So, need to know the path in the server where the application is deployed and the certificate location, to proceed now, as the workaround solution.

Answer 3

See more details here: https://github.com/dotnet/runtime/issues/25143

The certificate was, indeed, present and was readable from the user running - so it's not an issue that the certificate can't be found!

The actual error is, I believe, that it can't put the certificate the LocalUser's cert store.

Here is what worked for me:

var issuerCertificate  = new X509Certificate2(caFileName, caPassword, X509KeyStorageFlags.MachineKeySet | X509KeyStorageFlags.Exportable);

Answer 4

!!! For all people with this problem who has toggled IIS and played with all the keyFlags !!!

I was having this issue on my local machine. Couldn't figure it out. So I inserted Directory.GetFiles(certs folder) above the X509 call to 6x check the file path was correct. new X509Certification2() started working.

The certs folder is outside of the project scope, and my project on my local had never accessed it before. The cert store must use a shadow folder structure you have to register by simply reading the files.

Hope this helps somebody before they spend half the day on this.