title: Sign data using smart card's private key with ASP.NET, Windows Authentication, and Impersonation
body: <p>I want to know if it is possible to sign data using a smart card's private key <strong>without</strong> resorting to a java applet or activex control.</p>
  
  <p><em>I am tantalizingly close!</em></p>
  
  <p>Our environment is:</p>
  
  <ul>
  <li>AD Domain</li>
  <li>PKI infrastructure/smart cards (PIV)</li>
  </ul>
  
  <p>I knocked up a simple ASP.NET (.net 4.0) web forms app with:</p>
  
  <ul>
  <li>Windows Authentication on, Anonymous off</li>
  <li>Identity Impersonate on</li>
  </ul>
  
  <p>With the smart card in the reader I can easily enumerate the certificates on the logged-in user's smart card (StoreLocation.CurrentUser). However, when I try to access the private key (via a CSP), I get an "Access Denied" error.</p>
  
  <p>On my local machine in debug mode everything works fine. I know - it's a cliche.</p>
  
  <pre><code>        protected void Page_Load(object sender, EventArgs e)
          {
  
              //always populate the cert store
              store = new X509Store(StoreName.My, StoreLocation.CurrentUser);
              store.Open(OpenFlags.MaxAllowed);
  
              RSACryptoServiceProvider csp = new RSACryptoServiceProvider();
  
              //hardcoded to get the first cert in the store - it's legit and had a private key
              cert = store.Certificates[0];
  
              //throws error when not local
              csp = (RSACryptoServiceProvider)cert.PrivateKey;
  
          }
  </code></pre>
  
  <p>I've tried giving app pool identities access to the certificate store to no avail.</p>