Search code examples
c#windowsfilecertificatex509certificate

Grant user permission to the private key

installing my WCF service I also install certificate with private key. Since I will be running service as a different user, that user needs access to the private key. I extensively read other stackoverflow questions and they all suggest permission on private key file in file system needs to adjusted. I do this by, 

        private static void AddUserPermissions(X509Certificate2 certificate, NTAccount user, StoreLocation storeLocation)
        {
            RSACryptoServiceProvider rsaProvider = (RSACryptoServiceProvider)certificate.PrivateKey;

            // Find file 
            string keyPath = FindKeyLocation(rsaProvider.CspKeyContainerInfo.UniqueKeyContainerName, storeLocation);
            FileInfo keyFileInfo = new FileInfo(keyPath);

            // Create new FileSecurity
            FileSecurity keyFileSecurity = keyFileInfo.GetAccessControl();
            keyFileSecurity.AddAccessRule(new FileSystemAccessRule(user, FileSystemRights.Read, AccessControlType.Allow));

            // Apply file security to the file
            keyFileInfo.SetAccessControl(keyFileSecurity);
        }

When I run my program and inspect the private key file I can see, for example "Network Service" has been added to the permissions list.

Great, that's working, but when WCF tries to use private key, it cannot access it.

Looking at certlm, certificate -> All Tasks -> Manage Private Keys.. I can see that my user is not on the list. Adding my user through GUI solves the issue, but I need to do it in code!!

Solution

  • Crypto Service Provider (Microsoft RSA SChannel Cryptographic Provider)

    The keys are located in C:\ProgramData\Application Data\Microsoft\Crypto\RSA\MachineKeys and setting a normal file permission here is reflected in certlm.msc.

    CSP

    Crypto Next Generation (Microsoft Key Storage Provider)

    The keys are located in C:\ProgramData\Application Data\Microsoft\Crypto\Keys and setting a normal file permission here is reflected in certlm.msc.

    CNG

    Summary

    Ensure you modify the permissions on the right file in the right location.