Recently, our enterprise began issuing new CNG server certificates. We just installed the first of these on an app server, and it seems to have broken a web services call with the error “Invalid provider type specified”.

In examining the PKS file, the provider appears to be “Microsoft Software Key Storage Provider”.

If I import the cert into the local key store, but override the CSP to “Microsoft Enhanced RSA and AES Cryptographic Provider”, it works fine, but ideally, I would like the app to work without overriding the CSP.

I am guessing that the core issue is in this snippet of code:

var store2 = X509CertificateStore.LocalMachineStore(X509CertificateStore.MyStore);
store2.OpenRead();

var coll2 = store2.FindCertificateBySubjectString(ConfigurationManager.AppSettings["<redacted>"]);

if (coll2.Count > 0)
{
//var cert2    = new X509Certificate2(coll2[0]);
  var cert2    = coll2[0];
  var certType = cert2.GetType();
  var cert3    = new X509Certificate2(cert2);
  certType     = cert3.GetType();

  if (cert2.SupportsDigitalSignature)
  {
    svc.ClientCredentials.ClientCertificate.Certificate = new X509Certificate2(cert2);
  }
}

As best I can tell, the code is looking for certificate(s) that match the local servers name (i.e. appserver.fqdn.com) in the Local Cert Store (coll2), creating a new object from that raw data (cert2) and recasting it as an X509Certificate2 object. It then sets the Certificate attribute/tag in the web service’s ClientCredentials / ClientCertificate / Certificate attribute. I am guessing there is something subtle about CNG that is not working here, but I am uncertain how to update the code to properly pass the identity certificate to the web services call.

If I import the certificate into the local certificate store, but override the CSP, (“certutil.exe -csp “Microsoft Enhanced RSA and AES Cryptographic Provider” -importpfx <certificate file>”), the code works as expected, but I would like to update the code to work without this admin step.