无法获取 WCF 服务中私钥的权限
当我使用 HTTP 在 Win7 上运行 WCF 服务时，收到错误“证书‘CN=tempcert’必须具有能够进行密钥交换的私钥。该进程必须具有私钥的访问权限”。我将应用程序池更改为使用“NetworkService”。我使用本地计算机安装了服务器证书。该证书显示在本地计算机/个人/证书下的证书 MMC 中。我双击证书，它表明它有一个私钥。然后，我运行 FindPrivateKey 实用程序，它指出它在 C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys 文件夹中找到私钥。我进入 MMC 中的证书插件并授予 NETWORK SERVICE 帐户的完全权限。然后我进入Windows资源管理器中的文件夹并确认NETWORK SERVICE对该文件夹和特定密钥文件具有完全权限。但是，每次运行 WCF 服务时都会出错，无法找到私钥。我不知道我还能做什么。
I am getting the error "The certificate 'CN=tempcert' must have a private key that is capable of key exchange. The process must have access rights for the private key" when I run a WCF service on Win7 using HTTP. I change the Application Pool to use "NetworkService". I installed the server certificate using the Local Machine. The cert is shown in the Certificate MMC under the Local Computer / Personal / Certificates. I double click on the certificate and it states that it has a private key. I then run the FindPrivateKey utility and it states that it finds the private key in C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys folder. I went into the Certificates Addin in MMC and granted full rights to the NETWORK SERVICE account. Then I went to the folder in Windows Explorer and confirmed that NETWORK SERVICE has full rights to the folder and the specific key file. However, everytime I run the WCF service it errors out that it can't find the private key. I have no idea what else I can do.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
创建证书时需要指定
-sky Exchange。You need to specify
-sky exchangewhen you create the certificate.我也曾为此苦苦挣扎。没有快速解决办法。 “-sky Exchange”可能是导致此错误的原因，但我在构建自签名证书时设置了“-sky Exchange”，但仍然收到此错误。还有其他问题可能导致此问题，包括私钥访问权限和证书位置。
如果/当您将 WCF 主机作为 Windows 服务运行时，这可能适用：
私钥的访问权限
就我而言，如果我手动启动 WCF 服务，它会继承我的（管理组）用户帐户的权限，并且 WCF 服务在查找证书时没有问题。但是，当我使用 Windows 服务启动 WCF 主机时，它继承了该服务的权限，并且我收到了同样的错误。
在“服务管理器”窗口中，就我而言，运行我的服务的帐户显示为“本地系统”，这实际上意味着“NT AUthority/系统”。因此，我需要向该帐户授予对该帐户的私钥容器的访问权限。令人惊讶的是，“每个人”都不够好。您可以使用 MMC 或使用 FindPrivatekey.exe 为密钥容器分配权限，并使用文件资源管理器手动设置权限，就像设置文件夹的访问权限一样。
商店位置 - 另一个因素
另外，就我而言，我运行的帐户无法访问“LocalMachine”或“CurrentUser”存储，因此在那里找到我的证书是没有用的。仅当我使用 MMC 将证书导入（或复制）到“服务（服务名称）”时，该服务才开始工作。
您可以这样做：打开 MMC，然后从列表中选择“证书”。您将看到三个选项：我的用户帐户（CurrentUser）、服务帐户（您选择哪个服务）和计算机帐户（LocalMachine）。只需选择服务帐户并选择 WCF 主机运行的服务即可。
我在这里的回答并不是完整的“如何做”，只是为那些在这个问题上苦苦挣扎的人提供有用的提示。我为文档编写的“如何做”长达 10 页。
I've struggled with this too. There's no quick fix. The "-sky exchange" can be the cause of this error, but I had "-sky exchange" set when building self-signed certs and still received this error. There are other issues that can cause this problem, including private key access rights and the certificate location.
This can apply if/when you're running your WCF host as a Windows service:
Access rights to the private key
In my case, if I started the WCF service manually, it inherited the rights of my (admin group) user account adn the WCF service had no problem finding the certs. But when I used a Windows Service to start the WCF host, it inherited the rights of the service, and I received this same error.
In the Service Manager window, in my case, the account running my service shows up as "Local System", which really means "NT AUthority/System". So I needed to give that account access rights to the private key container to that account. "Everyone" wasn't good enough, amazingly. You can assign rights to the key containter using the MMC or usign FindPrivatekey.exe and manually using the file explorer to set the rights, much like you'd set access rights to a file folder.
Store Location -another factor
Also, in my case, the account I was running under didn't have access to the "LocalMachine" or "CurrentUser" stores, so locating my certs there was of no use. The service only started working when I imported (or copied) the certificates to "Service (Service Name)" using the MMC.
You can do it this way: open up the MMC, then select "Certificates" from the list. You'll see three options: My User Account (CurrentUser), Service Account (You select which service) and Computer Account (LocalMachine). Just select Service Account and pick the service under which your WCF host runs.
My answer here was not meant to be a complete "how to", just helpful hints to those struggling with this issue. The "how to" I wrote for my documentation was 10-pages long.
MMC>文件>添加/删除管理单元>证书>添加>电脑帐户>下一页>完成> OK
然后，找到证书>右键单击>所有任务>管理私钥
添加正在使用证书的用户或服务并授予其完全控制权。
您已准备就绪:) 重新启动服务，它应该可以工作
mmc > File > Add/Remove Snap-in > Certificate > Add > Computer Account > Next > Finish > OK
Then, find the certificate > Right Click > All Tasks > Manage Private Keys
Add the user or service which is using the cert and grant full control to it.
You are all set :) Restart the service and it should work
我也遇到了这个异常。检查内部异常显示：
System.Security.Cryptography.CryptographyException：指定的提供程序类型无效。事实证明，我在 Windows Server 2008 上的 .NET 3.5 中使用 CNG 证书，本文 (https://msdn.microsoft.com/en-us/library/aa738624(v=vs.100).aspx) 突出显示为不受支持。
要查看您正在使用的证书类型，您可以运行命令
Certutil -store my并查找 Provider 字段。无论如何，我希望这些信息对遇到同样问题的人有用。
I was getting this exception too. Inspecting the inner exception showed :
System.Security.Cryptography.CryptographicException: Invalid provider type specified.It turns out I was using a CNG certificate in .NET 3.5 on a windows server 2008, which this article (https://msdn.microsoft.com/en-us/library/aa738624(v=vs.100).aspx) highlights as unsupported.
To see what certificate type you are using, you can run the command
Certutil -store myand look for the Provider field.Anyway, I hope this information is useful for someone with the same problems.