title: Service Fabric: Authenticating with Azure KeyVault via cert: "KeySet does not exist"
body: <p>This is the scenario I am trying to enable:</p>
  
  <p><strong>I wish to authenticate to an azure keyvault from my web service application (azure service fabric) via a client certificate.</strong></p>
  
  <p>These are the steps I'm following:</p>
  
  <ol>
  <li>Add a certificate to my keyvault in azure (self signed)</li>
  <li>Download certificate via azure powershell (pfx)</li>
  <li>Create Azure App Instance to identify my app</li>
  <li>Associate certificate with app</li>
  <li>Create service principal for the azure app</li>
  <li>Give principal access to keyvault</li>
  </ol>
  
  <p>All looks good. When I spin up my service (local service fabric cluster), and try to connect to keyvault to retrieve a secret key+value that I have stored inside, I get error:</p>
  
  <blockquote>
    <p>CryptographicException: "KeySet does not exist"</p>
  </blockquote>
  
  <p>When I try to examine PrivateKey property value of the X509Certificate2 object at runtime, it throws the same exception.</p>
  
  <p>The certificate is found, and the private key exists (I verified this via MMC as well as some command line tools).</p>
  
  <p>What can I be missing? Only cause I can think of for this failure is that service fabric user context (Network Service, I think) does not have permission to look at private key? It is stored in "LocalMachine" certificate store, under 
  Personal" folder (also referred to as "My"). From what I know, applications should be able to read from LocalMachine store without special permissions?</p>