Windows Docker IIS App Pool not able to read certificates from local cert store

Question

I've asp.net MVC website hosted within docker container. The site needs to read the certificates stored on cert:\currentuser\my and present it to the Azure AD for app authentication.

I've loaded the pfx certs on to docker as part of image build per below:

# Install cert, located at certs folder in the host machine, relative to the path of the Solution Dockerfile
SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop'; $ProgressPreference = 'SilentlyContinue';"]
WORKDIR C:\certs
COPY ./certs .\

RUN Get-ChildItem -File | Foreach { Import-PfxCertificate -Password (ConvertTo-SecureString -String "xyz1234" -AsPlainText -Force)  -CertStoreLocation Cert:\CurrentUser\My -FilePath $_.fullname }

Then have this simple test aspx to read the cert by thumprint:

public X509Certificate2 FindCertificateByThumbprint(string findValue, bool validateCertificate)
    {
        X509Store store = new X509Store(StoreName.My, StoreLocation.CurrentUser);
        try
        {
            store.Open(OpenFlags.ReadOnly);
            X509Certificate2Collection col = store.Certificates.Find(X509FindType.FindByThumbprint,
                findValue, validateCertificate);
            if (col == null || col.Count == 0)
                return null;
            return col[0];
        }
        finally
        {
            store.Close();
        }
    }

Note:

On non docker (local laptop), This works perfectly OK for web.
On docker container, console app can find the certificate but not web app.

I tried all these but no luck:

https://newbedev.com/how-to-grant-permission-to-user-on-certificate-private-key-using-powershell

How to Grant permission to user on Certificate private key using powershell?

https://www.codyhosterman.com/2019/06/assigning-read-access-to-windows-private-key/

Feels like I'm missing a step here but not sure what. Has anyone got

Windows Docker IIS App Pool not able to read certificates from local cert store

0 Answers0