title: How to solve "Key not valid for use in specified state" error when using Azure ACS?
body: <p>I'm attempting to get OpenID authentication to work in my Azure ASP.NET MVC 3 application and have followed the steps in the <a href="http://acs.codeplex.com/wikipage?title=MVC3%20Custom%20Login&amp;referringTitle=Samples" rel="nofollow">MVC 3 Custom Login Sample</a> to do so. Everything works fine in the development environment but not when deployed to the Azure platform.</p>
  
  <p>The first issue started with authentication causing the error <strong>"Key not valid for use in specified state"</strong>. The <a href="http://acs.codeplex.com/discussions/245441" rel="nofollow">discussion here</a> states that the application needs to be configured to use RsaEncryptionCookieTransform instead of DPAPI which is the default. To try and solve this I added the code for <code>OnServiceConfigurationCreated</code> described <a href="http://blogs.msdn.com/b/alikl/archive/2011/03/19/windows-azure-web-role-asp-net-application-federated-authentication-using-appfabric-access-control-service-acs-v2-part-2.aspx" rel="nofollow">on Alik Levin's blog</a> but didn't go any further as it describes setting up a self-signed certificate in development (which as mentioned hasn't been necessary), not in Azure.</p>
  
  <p>Instead of that approach, I tried to use the X.509 certificate already in Azure. I found the thumbprint under Windows Azure Management > Access Control Service > Relying Party Applications > (My Application Name) > Token Signing Certificates > Used for Service Namespace (X.509 Certificate). I then added this reference to the web.config:</p>
  
  <pre><code>&lt;serviceCertificate&gt;
      &lt;certificateReference x509FindType="FindByThumbprint" findValue="8A417..." /&gt;
  &lt;/serviceCertificate&gt;
  </code></pre>
  
  <p>Now I receive a configuration error on application startup:</p>
  
  <pre>
  ID1024: The configuration property value is not valid.
  Property name: 'certificateReference'
  Error: 'ID1025: Cannot find a unique certificate that matches the criteria.
  StoreName: 'My'
  StoreLocation: 'LocalMachine'
  X509FindType: 'FindByThumbprint'
  FindValue: '8A417...''
  </pre>
  
  <p>Do I actually need to change the encryption method to resolve the "Key not valid for use in specified state" error? If so, how can I use the X.509 certificate already in Azure to encrypt cookies?</p>