0

I'm trying to instantiate a X509Certificate2 object in a Web Job, in an Azure App Service. The certificate is a PFX file.

When I try to instantiate like this, it fails to use the object in a WS call:

new X509Certificate2(byteArray, password, X509KeyStorageFlags.MachineKeySet | X509KeyStorageFlags.UserKeySet | X509KeyStorageFlags.EphemeralKeySet)

By failing, I mean it starts throwing: System.Net.WebException: The request was aborted: Could not create SSL/TLS secure channel.

But when I try like this, the WS works correctly:

new X509Certificate2(byteArray, password, X509KeyStorageFlags.MachineKeySet | X509KeyStorageFlags.UserKeySet)

The only difference is the user of X509KeyStorageFlags.EphemeralKeySet. The app is running on .Net Framework 4.7.2. Does anybody know why this happens?

A little explanation: we've had a issue with disk space in the App Service and we've read in some articles and in some SO questions/answers that this could have been caused by the fact that Windows writes to disk all certificates read, thus consuming a lot of space.

One example is this question.

user16735407
  • 43
  • 6

1 Answers1

2

SslStream, on Windows, can't work with EphemeralKeySet keys. The underlying reason is that Windows doesn't do TLS in-proc, but does all of the crypto operations in a different process. Their current functionality doesn't try to export/transport ephemeral keys to that other process, so it fails on the other side with "I can't find the private key".

bartonjs
  • 30,352
  • 2
  • 71
  • 111
  • Thanks for your answer. You mentioned "on Windows", but I forgot to write that this works on an Azure VM. Didn't you want to say "on App Service" instead of "on Windows"? – user16735407 Oct 20 '21 at 17:46
  • Nope, “on Windows”. If it works on your VM then the VM isn’t using Windows, Windows has finally changed the TLS provider to make that work, or something in the middle is detecting that you’re in that state and doing exciting compact work (like exporting and reimporting the cert+key). But for a direct call to SslStream, it’s “on Windows” to the best of my knowledge. – bartonjs Oct 20 '21 at 20:11