title: Certificates: Cannot find the certificate and private key for decryption Error when sign
body: <p>I work in company with many servers and Pcs for developers. Servers are win2003, PC developers Windows XP.</p>
  
  <p>In a server Win2003 named preiis01, in preproduction environment, other people in company install a client certificate using any other user (domainCompany\adminsystems) for logging in server preiis01.</p>
  
  <p>Anyone admin uses the user "domainCompany\adminsystems" for log in server preiis01 (using Terminal Server, Remote Desktop for Windows XP).</p>
  
  <p>the admin user is domainCompany\adminsystems", which installs certificate.</p>
  
  <p>Admin user install it like this:</p>
  
  <p>Session login like "domainCompany\adminsystems"
  Certificate is PFX file. Do Install PFX and using Wizard. The key private not check for export.
  Input the password and install.</p>
  
  <p>There is an application Web which AppPool Identity is: NETWORK SERVICE account.</p>
  
  <p>web server is IIS 6.0.</p>
  
  <p>in preiis01,</p>
  
  <p>That admin user executes mmc -> Snap in -> Certificates for Local Machine. In node -> Personal -> Certificates, he had seen the client certificate:</p>
  
  <p>Issued To ENTIDAD COMPANY INSURE SA - CIF A93 - NOMBRE SURNAME1 NAME1</p>
  
  <p>Issued By FNMT Clase 2 CA</p>
  
  <p>In properties of certificate, the thumbprint: "93 bc a4 ad 58 c9 3c af 8b eb 0b 2f 86 c7 9d 81 70 a6 c4 13"</p>
  
  <p>That admin user executes this commands:</p>
  
  <p>winhttpcertcfg.exe LOCAL_MACHINE\My -s "ENTIDAD COMPANY INSURE SA - CIF A93 - NOMBRE SURNAME1 NAME1" -g -a "NETWORK SERVICE"</p>
  
  <p>Result is:</p>
  
  <blockquote>
    <p>Matching certificate:</p>
    
    <p>CN=ENTIDAD COMPANY INSURE SA - CIF A93 - NOMBRE SURNAME1 NAME1</p>
    
    <p>OU=703015476</p>
    
    <p>OU=FNMT Clase 2 CA</p>
    
    <p>O=FNMT</p>
    
    <p>C=ES</p>
    
    <p>Granting private key access for
    account: NT AUTHORITY\NETWORK SERVICE</p>
  </blockquote>
  
  <p>Now, admin user executes this command:</p>
  
  <p>winhttpcertcfg.exe -l -c LOCAL_MACHINE\My -s "ENTIDAD COMPANY INSURE SA - CIF A93 - NOMBRE SURNAME1 NAME1"</p>
  
  <p>The result is:</p>
  
  <blockquote>
    <p>Matching certificate:</p>
    
    <p>CN=ENTIDAD COMPANY INSURE SA - CIF A93 - NOMBRE SURNAME1 NAME1</p>
    
    <p>OU=700012476</p>
    
    <p>OU=FNMT Clase 2 CA</p>
    
    <p>O=FNMT</p>
    
    <p>C=ES</p>
    
    <p>Additional accounts and groups with
    access to the private key include: 
      domainCompany\adminsystems  NT
    AUTHORITY\SYSTEM
      BUILTIN\Administrators  NT
    AUTHORITY\NETWORK SERVICE</p>
  </blockquote>
  
  <p>NOw, in an aspx page in application web in server Win2003, IIS 6.0, I have this code:</p>
  
  <p>NOte: value for X509Certificate2.HasPrivateKeyAccess() is NO (false) for "ENTIDAD COMPANY INSURE SA - CIF A93 - NOMBRE SURNAME1 NAME1" certificate.</p>
  
  <p>ASP.NET application executes using the identity :: NT AUTHORITY\NETWORK SERVICE</p>
  
  <pre><code>lbInfo.Text += "&lt;br/&gt;&lt;br/&gt;ASP.NET application executes using the identity :: &lt;b&gt;" + WindowsIdentity.GetCurrent().Name + "&lt;/b&gt;&lt;br&gt;";
  
  
              var store = new X509Store(StoreLocation.LocalMachine);
              store.Open(OpenFlags.ReadOnly | OpenFlags.OpenExistingOnly);
              Certificates = store.Certificates;
              repeater1.DataSource = Certificates;
              repeater1.DataBind();
  
              var nombreCertificado = "ENTIDAD COMPANY INSURE SA - CIF A93 - NOMBRE SURNAME1 NAME1";
  
              store = new X509Store(StoreName.My, StoreLocation.LocalMachine);
              store.Open(OpenFlags.ReadOnly);
  
              X509Certificate2Collection col = store.Certificates.Find(X509FindType.FindBySubjectName, nombreCertificado, false);
  
              if (col.Count &gt; 0)
              {
                  X509Certificate2 certificate = col[0];
                  store.Close();
                  Message.Text = "Certificado " + nombreCertificado + " encontrado en " + StoreLocation.LocalMachine;
  
                  FirmarConCertificado(nombreCertificado, certificate);
  
              }
              else
              {
                  store.Close();
                  Message.Text = "El certificado " + nombreCertificado + " no esta instalado en la máquina";
              }
  
  
  public void FirmarConCertificado(string nombreCertificado, X509Certificate2 certificate)
  {
      try
      {
   var mensaje = "Datos de prueba";
                  System.Text.Encoding enc = System.Text.Encoding.Default;
                  byte[] data = enc.GetBytes(mensaje);
  
                  var contentInfo = new System.Security.Cryptography.Pkcs.ContentInfo(data);
                  var signedCms = new System.Security.Cryptography.Pkcs.SignedCms(contentInfo, true);
  
                  var cmsSigner = new System.Security.Cryptography.Pkcs.CmsSigner(certificate);
  
                  //  Sign the CMS/PKCS #7 message
                  signedCms.ComputeSignature(cmsSigner);
  
                  //  Encode the CMS/PKCS #7 message
                 var ret = Convert.ToBase64String(signedCms.Encode());
  
   Message.Text += "Firmado con Certificado " + nombreCertificado + " encontrado en " + StoreLocation.LocalMachine;
   }
   catch (Exception ex)
   {
   Message.Text = "Error al firmar con certificado: " + ex.ToString();
   Message.Text += "&lt;br /&gt;&lt;br /&gt;InnerException: " + ex.InnerException;
   }
  
  }
  </code></pre>
  
  <p>The code fails for me, and I get this error: Cannot find the certificate and private key for decryption.</p>
  
  <p>Error line is:signedCms.ComputeSignature(cmsSigner);</p>
  
  <blockquote>
    <p>Error al firmar con certificado:
    System.Security.Cryptography.CryptographicException:
    Cannot find the certificate and
    private key for decryption.</p>
    
    <p>at
    System.Security.Cryptography.Pkcs.PkcsUtils.CreateSignerEncodeInfo(CmsSigner
    signer, Boolean silent) at
    System.Security.Cryptography.Pkcs.SignedCms.Sign(CmsSigner
    signer, Boolean silent) at
    System.Security.Cryptography.Pkcs.SignedCms.ComputeSignature(CmsSigner
    signer, Boolean silent) at
    System.Security.Cryptography.Pkcs.SignedCms.ComputeSignature(CmsSigner
    signer) at
    ASP.dgsfp_test_testcert_aspx.FirmarConCertificado(String
    nombreCertificado, X509Certificate2
    certificate) in
    c:\Company\App\Test\TestCert.aspx:line
    242</p>
  </blockquote>
  
  <p>Then, the admin user (I remember, who install the certificate) executes this commands:</p>
  
  <blockquote>
    <p>FindPrivateKey My LocalMachine -t "93
    bc a4 ad 58 c9 3c af 8b eb 0b 2f 86 c7
    9d 81 70 a6 c4 13" –c   </p>
    
    <p>FindPrivateKey
    My LocalMachine -n "ENTIDAD COMPANY INSURE SA - CIF A93 - NOMBRE SURNAME1 NAME1" –a</p>
    
    <p>FindPrivateKey My LocalMachine -n
    "CN=ENTIDAD COMPANY INSURE SA - CIF A93 - NOMBRE SURNAME1 NAME1"
    –a</p>
  </blockquote>
  
  <p>The result for all 3 commands is the same:</p>
  
  <blockquote>
    <p>FindPrivateKey helps user to find the
    location of the Private Key file of a
    X.50 9 Certificate.</p>
    
    <p>Usage: FindPrivateKey [{ {-n } | {-t }
    } [-f | -d | -a]]</p>
    
    <p> subject name of the
    certificate</p>
    
    <p>  thumbprint of the
    certificate (use certmgr.exe to get
    it)</p>
    
    <p>-f            output file name only</p>
    
    <p>-d            output directory only</p>
    
    <p>-a            output absolute file
    name e.g. FindPrivateKey My
    CurrentUser -n "CN=John Doe"</p>
    
    <p>e.g. FindPrivateKey My LocalMachine -t
    "03 33 98 63 d0 47 e7 48 71 33 62 64
    76 5 c 4c 9d 42 1d 6b 52" -c</p>
  </blockquote>
  
  <p>FindPrivateKey don't get anything, but winhttpcertcfg.exe -l works fine (matching certificate) </p>
  
  <p>We have given privileges to the Network Service user using the winhttpcertcfg.exe tool, and in code ASP.NET (execute under Network Service account) the certificate is found. But fails when sign using certificate.</p>
  
  <p>If someone could give us some information about, or suggestions </p>
  
  <p>update:</p>
  
  <p>User in domain "domainCompany\Pre_Certificado" install Certificate in Store Local Machine.</p>
  
  <p>domainCompany\Pre_Certificado is Administrator, in IIS_WPG group, has Local Policies: “Log on as Service“</p>
  
  <p>I configure AppPool Identity in IIS 6.0 for : domainCompany\Pre_Certificado</p>
  
  <p>ASP.NET application executes using the identity :: domainCompany\Pre_Certificado</p>
  
  <p>I recycle AppPool and execute application, I get System.Security.Cryptography.CryptographicException: Cannot find the certificate and private key for decryption</p>
  
  <p>If I test again, log in session in server IIS, using domainCompany\Pre_Certificado user, I call page in ASP.NET application and all is OK.</p>
  
  <p>(note: log in server IIS using Terminal Server)</p>
  
  <p>But if log off session in server IIS (user: domainCompany\Pre_Certificado), I get the same error:</p>
  
  <p>System.Security.Cryptography.CryptographicException: Cannot find the certificate and private key for decryption</p>
  
  <p>Any suggestions ??</p>