dotnet web services enhancements: Private key not available for X.509 certificate under W2000 -- dotnet web services enhancements

You're in the

dotnet web services enhancements

group:

Private key not available for X.509 certificate under W2000

Diego Barros
6/21/2005 12:00:00 AM

dotnet web services enhancements:

Hi all,

I am having difficulty running a WSE 2.0 enabled Web Service under Windows
2000. I can run the same web service using X.509 certificates for
authentication and encryption when the web service is on a Windows 2003
Server (Enterprise Edition) and the caller is on my Windows 2000 machine.

But when the Web Service is on the same Windows 2000 machine I get the
following returned from the web service call:

Message "System.Web.Services.Protocols.SoapHeaderException: Server
unavailable, please try later ---> System.InvalidOperationException: Private
Key is not available\n at
Microsoft.Web.Services2.Security.Cryptography.RSACryptoServiceProvider.Decrypt(Byte[]
ciphertext, Boolean useOAEP)\n at
Microsoft.Web.Services2.Security.Cryptography.RSA15KeyExchangeFormatter.DecryptKey(Byte[]
cipherKey)\n at Microsoft.Web.Services2.Security.EncryptedKey.Decrypt()\n
at Microsoft.Web.Services2.Security.Security.LoadXml(XmlElement
element)\n at
Microsoft.Web.Services2.Security.SecurityInputFilter.ProcessMessage(SoapEnvelope
envelope)\n at
Microsoft.Web.Services2.Pipeline.ProcessInputMessage(SoapEnvelope
envelope)\n at
Microsoft.Web.Services2.WebServicesExtension.BeforeDeserializeServer(SoapServerMessage
message)\n --- End of inner exception stack trace ---" string

I have been looking around Google Groups and have found a few people talking
about there being difficulties in getting this to work on Windows 2000 and
storing certificates under the "Other People" branch of the certificate store.

In which certificate store does a WSE 2 web service look for a private
certificate key? Is it looking in "Other people"? Can I change this? I am
using VS.NET 2003 (C#). Is something just not supported under Windows 2000?

Re: Private key not available for X.509 certificate under W2000

Sidd [MSFT]
6/22/2005 11:00:53 PM

Hi Diego,

The exception below suggests that the correct certificate was found,
however, there were not enough permissions given to access the private key
file
of the certificate. The private key is used to very the signature. Have you
give private key permissions to your certificate? You can do this by using
the WSE Certificate tool,
clicking on the Private Key properties and then adding the "Users" group to
the ACL's of the file.

In general, when verifying signature or decrypting on the server side,
the LocalMachine/Personal store is used in order to retrieve the
certificate. This is the default store unless it is explicitly specified as
something else in the configuration file.

Let me know if this helps

Sidd [MSFT]

[quoted text, click to view]

Re: Private key not available for X.509 certificate under W2000

Julie Lerman
6/24/2005 12:00:00 AM

One thing to note: in the Hands on Labs, the instructions say to tive the
ASPNET account access to teh server certificate.

I am developing as a non-admin, not using IIS but the file based server and
this did not work. For TESTING and DEVELOPMENT purposes, I gave my login
account access to the server certificate (in local machine/personal)
instead.

Julie

[quoted text, click to view]

Got something to say? Click here to post a reply to this thread.

Don't see what you're looking for? Try a search.

View other messages in the dotnet web services enhancements group.

home · blog · groups

Questions? Comments? Contact the dn