title: System.Security.Cryptography.CryptographicException: The parameter is incorrect
body: <p>I have the  following exception when a try create  a new Instance of ServiceHost (new ServiceHost(serviceType, baseAddresses))</p>
  
  <pre><code>System.Security.Cryptography.CryptographicException: The parameter is incorrect.
  
  Stack Trace: 
  
  
  [CryptographicException: The parameter is incorrect.
  ]
     System.Security.Cryptography.X509Certificates.X509Certificate2Collection.LoadStoreFromBlob(Byte[] rawData, String password, UInt32 dwFlags, Boolean persistKeyContainers) +1871625
     System.Security.Cryptography.X509Certificates.X509Certificate2Collection.Import(Byte[] rawData, String password, X509KeyStorageFlags keyStorageFlags) +104
     System.ServiceModel.Description.ConfigLoader.LoadIdentity(IdentityElement element) +501
     System.ServiceModel.Description.ConfigLoader.LoadServiceDescription(ServiceHostBase host, ServiceDescription description, ServiceElement serviceElement, Action`1 addBaseAddress) +12346988
     System.ServiceModel.ServiceHostBase.LoadConfigurationSectionInternal(ConfigLoader configLoader, ServiceDescription description, ServiceElement serviceSection) +67
     System.ServiceModel.ServiceHostBase.ApplyConfiguration() +108
     System.ServiceModel.ServiceHostBase.InitializeDescription(UriSchemeKeyedCollection baseAddresses) +192
     System.ServiceModel.ServiceHost.InitializeDescription(Type serviceType, UriSchemeKeyedCollection baseAddresses) +49
     System.ServiceModel.ServiceHost..ctor(Type serviceType, Uri[] baseAddresses) +151
     STARTAccessPoint.StartServiceFactory.CreateServiceHost(Type serviceType, Uri[] baseAddresses) in D:\Work\Projects\Marlo\LIME\projecto_start\start\project\START\STARTAccessPoint\accesspointService.svc.cs:273
     System.ServiceModel.Activation.ServiceHostFactory.CreateServiceHost(String constructorString, Uri[] baseAddresses) +422
     System.ServiceModel.HostingManager.CreateService(String normalizedVirtualPath) +1461
     System.ServiceModel.HostingManager.ActivateService(String normalizedVirtualPath) +44
     System.ServiceModel.HostingManager.EnsureServiceAvailable(String normalizedVirtualPath) +651
  
  [ServiceActivationException: The service '/accesspointService.svc' cannot be activated due to an exception during compilation.  The exception message is: The parameter is incorrect.
  .]
     System.Runtime.AsyncResult.End(IAsyncResult result) +688590
     System.ServiceModel.Activation.HostedHttpRequestAsyncResult.End(IAsyncResult result) +190
     System.ServiceModel.Activation.ServiceHttpModule.EndProcessRequest(IAsyncResult ar) +310694
     System.Web.AsyncEventExecutionStep.OnAsyncEventCompletion(IAsyncResult ar) +94
  </code></pre>
  
  <p>Here is the code that I use: </p>
  
  <pre><code>protected override ServiceHost CreateServiceHost(Type serviceType, Uri[] baseAddresses)
      {
          if (!CertificatesConfiguration.HasServiceCredentials(serviceType.FullName))
          {
              throw new ConfigurationErrorsException(String.Format("Config section does not contain service credentials for service \"{0}\".", serviceType.FullName));
          }
          var credentials = CertificatesConfiguration.ServiceCredentials.ByServiceName(serviceType.FullName);
  
          //X509Certificate cert = credentials.ServiceCertificate.Certificate;
  
          return InitServiceHost(new ServiceHost(serviceType, baseAddresses),typeof(STARTAccessPoint.Resource),credentials.ServiceCertificate.Certificate);
      }
  </code></pre>
  
  <p>This is my Web.Config :</p>
  
  <pre><code>&lt;services&gt;
    &lt;service name="STARTAccessPoint.accesspointService" behaviorConfiguration="SecureServiceBehavior"&gt;
      &lt;endpoint address="" name="ResourceBindingPort" binding="customBinding" bindingNamespace="http://www.w3.org/2009/02/ws-tra" bindingConfiguration="SecureServiceBinding" contract="STARTAccessPoint.Resource"&gt;
        &lt;identity&gt;
          &lt;certificate encodedValue=""/&gt;
        &lt;/identity&gt;
      &lt;/endpoint&gt;
    &lt;/service&gt;
  &lt;/services&gt;
  &lt;behaviors&gt;
    &lt;serviceBehaviors&gt;
      &lt;behavior name="SecureServiceBehavior"&gt;
        &lt;serviceMetadata httpsGetEnabled="true" externalMetadataLocation="https://localhost:1443/accesspointService.wsdl.xml"/&gt;
        &lt;serviceDebug includeExceptionDetailInFaults="true"/&gt;
      &lt;/behavior&gt;
    &lt;/serviceBehaviors&gt;
    &lt;endpointBehaviors&gt;
      &lt;behavior name="SecureClientBehavior"&gt;
      &lt;/behavior&gt;
    &lt;/endpointBehaviors&gt;
  &lt;/behaviors&gt;
  &lt;bindings&gt;
    &lt;customBinding&gt;
      &lt;binding name="SecureServiceBinding" closeTimeout="00:01:30" openTimeout="00:01:30" sendTimeout="00:01:30" receiveTimeout="00:01:30"&gt;
        &lt;reliableSession ordered="true" reliableMessagingVersion="WSReliableMessaging11" flowControlEnabled="false" maxRetryCount="4" inactivityTimeout="00:01:00"/&gt;
        &lt;security defaultAlgorithmSuite="Basic128" allowSerializedSigningTokenOnReply="true" authenticationMode="MutualCertificate" requireDerivedKeys="false" securityHeaderLayout="Lax" messageProtectionOrder="SignBeforeEncrypt" messageSecurityVersion="WSSecurity10WSTrust13WSSecureConversation13WSSecurityPolicy12BasicSecurityProfile10" requireSignatureConfirmation="false"&gt;
          &lt;issuedTokenParameters keyType="SymmetricKey"/&gt;
          &lt;secureConversationBootstrap/&gt;
        &lt;/security&gt;
        &lt;httpsTransport authenticationScheme="Anonymous" hostNameComparisonMode="WeakWildcard" proxyAuthenticationScheme="Anonymous"/&gt;
      &lt;/binding&gt;
    &lt;/customBinding&gt;
  &lt;/bindings&gt;
  </code></pre>
  
  <p>Cerificates Config File, with all information about the Certificates:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;peppol.certificates&gt;
    &lt;validation&gt;
      &lt;add name="MyRootCertificates"
           rootCACertificateThumbprint=""
           intermediateAcessPointCACertificateThumbprint="‎"/&gt;
    &lt;/validation&gt;
  
    &lt;serviceCredentials&gt;
      &lt;add serviceName="SecureClient_at_localhost"&gt;
        &lt;serviceCertificate
            findValue="‎7a6fa503ab57b81d6318a51ca265e739a51ce660"
            x509FindType="FindByThumbprint"
            storeName="Root"
            storeLocation="LocalMachine" /&gt;
      &lt;/add&gt;
      &lt;add serviceName="*"&gt;
        &lt;serviceCertificate
            findValue="‎7a6fa503ab57b81d6318a51ca265e739a51ce660"
            x509FindType="FindByThumbprint"
            storeName="Root"
            storeLocation="LocalMachine" /&gt;
      &lt;/add&gt;
    &lt;/serviceCredentials&gt;
    &lt;clientCredentials&gt;
      &lt;add endpointName="SecureClient_at_localhost"&gt;
        &lt;clientCertificate
          filename="c:\localhost.cer"
          password="" /&gt;
        &lt;serviceCertificate
           findValue="‎7a6fa503ab57b81d6318a51ca265e739a51ce660"
           x509FindType="FindByThumbprint"
           storeName="Root"
           storeLocation="LocalMachine" /&gt;
      &lt;/add&gt;
      &lt;add endpointName="*"&gt;
        &lt;clientCertificate
          filename="c:\localhost.cer"
          password="" /&gt;
        &lt;serviceCertificate
          filename="c:\localhost.cer"
          password="" /&gt;
      &lt;/add&gt;
    &lt;/clientCredentials&gt;
  &lt;/peppol.certificates&gt;
  </code></pre>
  
  <p>Can you help?</p>