Strange Windows 2000 / 2003 behavior found with ASPNET permissions?!?

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance



Has anyone else come across this?

We are building an ASP.Net application that uses a certificate and
private key in the local machine store. (we are testing it both on
windows 2000 & 2003)

We failed accessing the private key of the certificate and as we tried
to figure out what is the problem we came across the following
Microsoft Article:
http://support.microsoft.com/d­efault.aspx?scid=kb;en-us;3275­87
(slightly different scenario, but similar), this article suggests
adding permissions to the ASPNET account to the "i:\Documents and
Settings\All Users\Application Data\Microsoft\Crypto\RSA\Mach­ineKeys"
folder.

After that we added the permissions to the ASPNET account the
application was able to work with the private key but we started seeing
strange behavior in other places.

For example, trying to import a pfx file into the local computer store
caused the following error:

"An internal error occurred. This can be either the user profile is not
accessible or the private key that you are importing might require a
cryptographic service provider that is not installed on your system."

the same operation works fine without adding the permissions for the
ASPNET user, i can't understand why adding permissions to a user would
cause other users problems ?


If this expected behavior when setting permissions on MachineKeys? Is
there a way to avoid this?

Any info would be great,
Thanks,
Hagai.

.



Relevant Pages

  • Re: HttpListener, SSL Certificates, Sever and client certificate a
    ... One thing to look out for is that files underneath the "keys" directory do ... NOT inherit permissions from the folder, so the ACL change you made there ... Certificate Services: ...
    (microsoft.public.dotnet.security)
  • Re: WSE - X.509 signed meesage- Multiple SoapExtensions
    ... > If my client sends a SOAP message that is signed using a X.509 certificate, ... Cannot find the certificate and private key for ... The error above indicates that either the client or the ... web.config file elements points to the local machine store. ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Re: X.509 Unwrap Woes
    ... You need to give read permissions over the private keys to ASP.NET. ... You can give those permissions using the Certificate tool provided by WSE or ... unwrap a symmetric key using the private key of an X.509 certificate. ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Strange Windows 2000 / 2003 behavior found with ASPNET permissions on MachineKeys folders?!?
    ... private key in the local machine store. ... We failed accessing the private key of the certificate and as we tried ... After that we added the permissions to the ASPNET account the ...
    (microsoft.public.security)
  • Re: Storing Client Certificates
    ... So the private key, in my case, would need to be installed on the ... client's machine in the local machine store to be independent of who is ... certificate to be physically separate from the private key pair (not a P12 ... > server can ensure that yes, the person with that client certificate ALSO ...
    (microsoft.public.dotnet.security)