Windows 2012 ASP.NET Event Error 1334

Windows 2012 R2 Standard
ASP.NET
IIS 8.5

This error pops up from time to time

Log Name:      Application
Source:        ASP.NET 2.0.50727.0
Date:          7/5/2015 6:11:01 AM
Event ID:      1334
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      SERV013.FQDN.com
Description:
An unhandled exception occurred and the process was terminated.

Application ID: DefaultDomain

Process ID: 8732

Exception: System.Security.Cryptography.CryptographicException

Message: Keyset does not exist


StackTrace:    at System.Security.Cryptography.CryptographicException.ThrowCryptogaphicException(Int32 hr)
   at System.Security.Cryptography.SafeKeyHandle._FreeHKey(IntPtr pKeyCtx)
   at System.Security.Cryptography.SafeKeyHandle.ReleaseHandle()
   at System.Runtime.InteropServices.SafeHandle.InternalFinalize()
   at System.Runtime.InteropServices.SafeHandle.Dispose(Boolean disposing)
   at System.Runtime.InteropServices.SafeHandle.Finalize()
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="ASP.NET 2.0.50727.0" />
    <EventID Qualifiers="49152">1334</EventID>
    <Level>2</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2015-07-05T10:11:01.000000000Z" />
    <EventRecordID>29051</EventRecordID>
    <Channel>Application</Channel>
    <Computer>SERV013.FQDN.com</Computer>
    <Security />
  </System>
  <EventData>
    <Data>An unhandled exception occurred and the process was terminated.

Application ID: DefaultDomain

Process ID: 8732

Exception: System.Security.Cryptography.CryptographicException

Message: Keyset does not exist


StackTrace:    at System.Security.Cryptography.CryptographicException.ThrowCryptogaphicException(Int32 hr)
   at System.Security.Cryptography.SafeKeyHandle._FreeHKey(IntPtr pKeyCtx)
   at System.Security.Cryptography.SafeKeyHandle.ReleaseHandle()
   at System.Runtime.InteropServices.SafeHandle.InternalFinalize()
   at System.Runtime.InteropServices.SafeHandle.Dispose(Boolean disposing)
   at System.Runtime.InteropServices.SafeHandle.Finalize()</Data>
  </EventData>
</Event>

Reported this a while back so I am opening it again.

I found this
https://msdn.microsoft.com/en-us/library/aa702621.aspx


How to retrieve thumb Print
https://msdn.microsoft.com/en-us/library/ms734695.aspx
User.FindPrivateKey My CurrentUser -n "CN=localhost" -a
findprivatekey.exe My CurrentUser -t "46 dd 0e 7a ed 0b 7a 31 9b 02 a3 a0 43 7a d8 3f 60 40 92 9d" -a

cacls.exe "C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8aeda5eb81555f14f8f9960745b5a40d_38f7de48-5ee9-452d-8a5a-92789d7110b1" /E /G "NETWORK SERVICE":R

It took me awhile to find "FindPrivateKey.EXE" but I now have it if anyone needs it you can find it here
http://blog.rhysgoodwin.com/windows-admin/findprivatekey-exe-pre-compiled/

so I ran the one above
C:\Util>findprivatekey My currentuser -n "CN=localhost" -a
FindPrivateKey failed for the following reason:
No certificates with key 'CN=localhost' found in the store.

Use /? option for help


I need to find which thumb pint it is so I can issue the cacls command

Also the path in the cacls is not correct for Windows 2012 Server after research I found the location of the machinekeys

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys

I found another article that said to give administrators and system full control

I tried that and I received access denied on the machinekeys


So my questions are this

1. how to use the findprivtekey.exe properly to obtain the thumb print then the cacls command should work?

2.  Why can't I add permissions to the folder "C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys" access denied




Thanks

Tom
LVL 23
Thomas GrassiSystems AdministratorAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Randy DownsOWNERCommented:
Try this.

Do download it from Web Services Enhancements (WSE) 3.0 for Microsoft .NET for the tools as the previous link is the runtime (missed that out, pardon me).
Note: WSE 3.0 is not supported if installed on a computer with a version of the .NET Framework earlier than 2.0 or a version of Visual Studio earlier than Visual Studio 2005.
https://www.microsoft.com/en-us/download/details.aspx?id=14089
0
btanExec ConsultantCommented:
There is step (1) and (2) as in the first link you shared in the post. This is important to make sure the account of the WCF services executing and the identified account certstore hold the cert and has the corresponding private keyset. It should be a SSL binding done in WCF - see "Configure SSL Certificate for WCF Service"
http://dotnetmentors.com/wcf/configure-iis-for-wcf-service-with-ssl-and-transport-secuirty.aspx

 You are running the tool finding a certificate with subject name as "localhost" which I does not exist. Does the currentuser has those certificate in the certstore
Start MMC and add the Certificate Snap-in, selecting the right container owner for your SSL certificate. Find the certificate (it's probably in the personal store), right click on it and choose All Tasks > Manage Private key. Grant read access to the private key to the user hosting your service.
pse also see the steps though it stated as "CN=yourservername.domain.local" but should be similar to localhost ...need to firm up the prev first.
http://www.itsolutionbraindumps.com/2011/02/finding-private-key-for-your.html

For the machinekey portion, it is to provide access to the account trying to access it
....
4.You’re going to add your ASP.NET Machine Account or IUSR_<AccountName> account and give it full permission. Click the "Add.." button. Then click "OK".
5.The ASP.NET Machine Account or IUSR account is now listed. Select it and then check the "Full Control" or “Modify” checkbox (causing all the other Allow checkboxes to be selected). Then click "Apply".
https://cedricboudoya.wordpress.com/2008/10/16/wcf-certificate-%E2%80%93-keyset-does-not-exist-%E2%80%93-part-2/
0
Thomas GrassiSystems AdministratorAuthor Commented:
Randy

Thanks for responding
I already have that tool

Any way without reviewing every certificate to find what I am looking for I by this error above?

The error is not very helpful to me not sure what to look for.
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Learn More
Thomas GrassiSystems AdministratorAuthor Commented:
Btan

thanks for responding

I will look at those items shortly.

Will post results
0
Thomas GrassiSystems AdministratorAuthor Commented:
Guys

Still struggling with FindPrivatekey and also found this certutil   see below

C:\Util>findprivatekey my currentuser -n "cn=domain\administrator" -a
FindPrivateKey failed for the following reason:
No certificates with key 'cn=our\administrator' found in the store.

Use /? option for help

C:\Util>findprivatekey my currentuser -n "cn=administrator" -a
FindPrivateKey failed for the following reason:
No certificates with key 'cn=administrator' found in the store.

Use /? option for help

C:\Util>findprivatekey my localmachine -n "cn=serv013" -a
FindPrivateKey failed for the following reason:
No certificates with key 'cn=serv013' found in the store.

Use /? option for help

C:\Util>findprivatekey my localmachine -n "cn=serv013.fqdn.com" -
a
FindPrivateKey failed for the following reason:
No certificates with key 'cn=serv013.fqdn.com' found in the store
.

Use /? option for help

C:\Util>findprivatekey my currentuser -n "cn=administrator.fqdn.com" -a
FindPrivateKey failed for the following reason:
No certificates with key 'cn=administrator.fqdn.com' found in the
 store.

Use /? option for help

C:\Util>



C:\Util>certutil -verifykeys
CertUtil: No local Certification Authority; use -config option
CertUtil: No more data is available.

C:\Util>certutil -getreg ca\cacerthash
CertUtil: -getreg command FAILED: 0x80070002 (WIN32: 2 ERROR_FILE_NOT_FOUND)
CertUtil: The system cannot find the file specified.

C:\Util>


What am I missing here

Thanks
0
Randy DownsOWNERCommented:
Did you see this?

The following command retrieves the private key for John Doe.
FindPrivateKey My CurrentUser -n "CN=John Doe"

The following command retrieves the private key for the local machine.
FindPrivateKey My LocalMachine -t "03 33 98 63 d0 47 e7 48 71 33 62 64 76 5c 4c 9d 42 1d 6b 52" –a

/t < thumbprint >
Specifies the thumbprint of the certificate. Use Certmgr.exe to retrieve the thumbprint of the certificate.
0
Thomas GrassiSystems AdministratorAuthor Commented:
Randy

Yes I tried that
C:\Util>findprivatekey my currentuser -n "cn=domain\administrator" -a
 FindPrivateKey failed for the following reason:
 No certificates with key 'cn=our\administrator' found in the store.


but the one with the thumb print is the one that I can not figure out.

First the error message does not tell me what certificate the problem is with.

In the message how can I tell which certificate is the problem?
0
Randy DownsOWNERCommented:
Try this.

This tool can help you find the actual file location of you cert with the cert’s Thumbprint. To find the thumbprint, open Microsoft Management Console.

Add the Certificates snap-in

You should be able to find your cert somewhere

Right click it, select Open. Click on the Details tab in the Certificate dialog. You should be able to find the Thumbprint of your cert.

Now with the thumbprint, run the following command in command line prompt. Note that in the example, I tried to retrieve the cert’s for the local machine. See this page for more details on this tool.

>FindPrivateKey my localmachine -t ” THUMBPRINT “

It will return the folder and name of your cert!
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Thomas GrassiSystems AdministratorAuthor Commented:
Guys

I believe I found the correct certification and made the changes

Lets see if we get this error again

Thanks for all your help
0
btanExec ConsultantCommented:
thanks for sharing - I believe you found via the MMC snap-in as I shared in the first post, if possible do share your findings to benefit more in EE at large.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2012

From novice to tech pro — start learning today.