title: Net Core Docker Container API. The certificate data cannot be read with the provided password at System.Security.Cryptography.CryptographicException
body: <p>The communication between a Web App Document Manager and Web API Document Uploader both in docker containers using HTTPS is not working. I was following the recommendation below on how we can use https in docker containers. I am assuming that I have to sort it out the SSL certificate in the API only.</p>
  <p><a href="https://github.com/dotnet/AspNetCore.Docs/issues/6199" rel="nofollow noreferrer">https://github.com/dotnet/AspNetCore.Docs/issues/6199</a></p>
  <p>Interesting point is that the https in the Web App Document Manager is working correctly out of the box, when I open the Web App in the browser the https is fine. I am very confused.</p>
  <p>I created the documentuploader.pfx  file as explained in this link <a href="https://github.com/dotnet/dotnet-docker/blob/main/samples/run-aspnetcore-https-development.md" rel="nofollow noreferrer">https://github.com/dotnet/dotnet-docker/blob/main/samples/run-aspnetcore-https-development.md</a></p>
  <p>However I got the response &quot;A valid HTTPS certificate is already present.&quot;, therefore I exported the one already existing named localhost.pfx, but it didn't work. I checked the password, but is correct.</p>
  <p>When I run the containers using docker compose I get the following error.</p>
  <pre><code>System.Security.Cryptography.CryptographicException
    HResult=0x80070056
    Message=The certificate data cannot be read with the provided password, the password may be incorrect.
    Source=System.Security.Cryptography.X509Certificates
    StackTrace:
     at Internal.Cryptography.Pal.UnixPkcs12Reader.Decrypt(SafePasswordHandle password)
     at Internal.Cryptography.Pal.PkcsFormatReader.TryReadPkcs12(OpenSslPkcs12Reader pfx, SafePasswordHandle password, Boolean single, ICertificatePal&amp; readPal, List`1&amp; readCerts)
     at Internal.Cryptography.Pal.PkcsFormatReader.TryReadPkcs12(ReadOnlySpan`1 rawData, SafePasswordHandle password, Boolean single, ICertificatePal&amp; readPal, List`1&amp; readCerts, Exception&amp; openSslException)
     at Internal.Cryptography.Pal.OpenSslX509CertificateReader.FromFile(String fileName, SafePasswordHandle password, X509KeyStorageFlags keyStorageFlags)
     at System.Security.Cryptography.X509Certificates.X509Certificate..ctor(String fileName, String password, X509KeyStorageFlags keyStorageFlags)
     at System.Security.Cryptography.X509Certificates.X509Certificate2..ctor(String fileName, String password)
     at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Certificates.CertificateConfigLoader.LoadCertificate(CertificateConfig certInfo, String endpointName)
     at Microsoft.AspNetCore.Server.Kestrel.KestrelConfigurationLoader.LoadDefaultCert()
     at Microsoft.AspNetCore.Server.Kestrel.KestrelConfigurationLoader.Reload()
     at Microsoft.AspNetCore.Server.Kestrel.KestrelConfigurationLoader.Load()
     at Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServerImpl.&lt;BindAsync&gt;d__32.MoveNext()
     at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
     at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
     at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
     at System.Runtime.CompilerServices.ConfiguredTaskAwaitable.ConfiguredTaskAwaiter.GetResult()
     at Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServerImpl.
  ...
  
  System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
     at System.Runtime.CompilerServices.TaskAwaiter.GetResult()
     at Microsoft.Extensions.Hosting.HostingAbstractionsHostExtensions.Run(IHost host)
     at DocumentUploader.Program.Main(String[] args)
  
    This exception was originally thrown at this call stack:
      Internal.Cryptography.Pal.UnixPkcs12Reader.VerifyAndDecrypt(System.ReadOnlySpan&lt;char&gt;, System.ReadOnlyMemory&lt;byte&gt;)
      Internal.Cryptography.Pal.UnixPkcs12Reader.Decrypt(Microsoft.Win32.SafeHandles.SafePasswordHandle)
  
  Inner Exception 1:
  CryptographicException: The certificate data cannot be read with the provided password, the password may be incorrect.
  
  </code></pre>
  <p>My docker compose is</p>
  <pre><code>version: '3.5'
  
  services:
    documentmanager:
      image: ${DOCKER_REGISTRY-}documentmanager
      environment:
        - ASPNETCORE_ENVIRONMENT=Development
        - ASPNETCORE_URLS=https://localhost;http://localhost
        - ASPNETCORE_HTTPS_PORT=44349   
        # Do not create development certificate in an environment that will be distributed.
        #- DOTNET_GENERATE_ASPNET_CERTIFICATE=false
      networks:
        - doc_manager
      ports:
        - &quot;51218:80&quot;
        - &quot;44349:443&quot;
      volumes:
        - ${APPDATA}/Microsoft/UserSecrets/:/root/.microsoft/usersecrets
        - ${APPDATA}/ASP.NET/Https/:/root/.aspnet/https/
      build:
        context: .
        dockerfile: Document Manager/Dockerfile
    documentuploader:
      image: ${DOCKER_REGISTRY-}documentuploader
      environment:
        - ASPNETCORE_ENVIRONMENT=Development
        - ASPNETCORE_URLS=https://localhost;http://localhost
        - ASPNETCORE_HTTPS_PORT=44335
        # Do not create development certificate in an environment that will be distributed.
        #- DOTNET_GENERATE_ASPNET_CERTIFICATE=false
      networks:
        - doc_manager
      ports:
        - &quot;51217:80&quot;
        - &quot;44335:443&quot;
      volumes:
        - ${APPDATA}/Microsoft/UserSecrets/:/root/.microsoft/usersecrets
        - ${APPDATA}/ASP.NET/Https/:/root/.aspnet/https/
      build:
        context: .
        dockerfile: DocumentUploader/Dockerfile
  
  networks:
    doc_manager:
      driver: bridge
  
  </code></pre>
  <p>My secret file in documentuploader api project is</p>
  <pre><code>    &quot;Kestrel&quot;: {
        &quot;Certificates&quot;: {
          &quot;Default&quot;: {
            &quot;Path&quot;: &quot;/root/.aspnet/https/documentuploader.pfx&quot;,
            &quot;Password&quot;: &quot;PASSWORD IS HERE&quot;
          }
        }
      }
  
  </code></pre>
  <p>My DocumentUploader.pfx is copied to /root/.aspnet/https folder in the container.</p>
  <p>When I check if the password is correct using openssl program, the content displayed is</p>
  <pre><code>MAC: sha1, Iteration 2000
  MAC length: 20, salt length: 20
  PKCS7 Data
  Shrouded Keybag: &lt;key bag here&gt;, Iteration 2000
  PKCS7 Encrypted data: &lt;PKCS7 here&gt;, Iteration 2000
  Certificate bag
  Bag Attributes
      localKeyID: 01 00 00 00
      friendlyName: IIS Express Development Certificate
  subject=CN = localhost
  
  issuer=CN = localhost
  
  ---BEGIN CERIFICATE---
  </code></pre>
  <p>Any help on it?</p>