Where should I store the private key (RSA) in a web application? My web application receives encrypted data from another server encrypted with RSA keys.  Where should I store the private key (RSA) in a .NET web application (Windows)? It seems that putting in it in the application data folder (app_data) probably isn't ideal.  Is there a 'best practice' for this? 

I wasn't sure if it's possible to convert the public/private key pair into another format and perhaps store it in the certificate store, but I'm not sure an RSA public/private key pair is even a "certificate". 

If this was a PCI compliance issue, it seems I would not even be allowed to store them on the same server, but I cannot then see how one could implement decryption on the server?
If you are in AWS, well and paranoid enough, you might want to use KMS. Google has a similar service. As for non-cloud environments, you can use either an HSM or a KMIP key server. Both HSMs and KMIP servers can be built in an High Availability way, and Amazon offer a good option to use SafeNet HSMs in the cloud, the service is called CloudHSM.

I am not a .Net expert, any more, but my understanding is that it has some adapters to plug in an PKCS#11 engine (HSM) transparently, so that you don't have to write any code for this to work. But it's probably a lot of configuration ugly work to get it to work.