File not found on RSACryptoServiceProvider, service account permissions?

Question

Our web service wraps around a third party library that contains the following code.

We are using an Active Directory service account in the IIS 6 app pool (no interactive login abilities). Our service fails with the error “The system cannot find the file specified”. We’ve traced the error to the “RSACryptoServiceProvider provider = new RSACryptoServiceProvider();”. The third party assembly depends on a x509 file based certificate for its encryption process and the Service Account has Read / Write access to the keys folder. Additionally, the service account has Read, Write, Modify rights to “C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys”.

Code:

StringBuilder builder = new StringBuilder(publicKeyData);
builder.Replace("-----BEGIN CERTIFICATE-----", "");
builder.Replace("-----END CERTIFICATE-----", "");
X509Certificate2 certificate = new X509Certificate2( Convert.FromBase64String(builder.ToString()));

string xmlString = certificate.PublicKey.Key.ToXmlString(false);

RSACryptoServiceProvider provider = new RSACryptoServiceProvider(); //BOOM
CspKeyContainerInfo containerInfo = provider.CspKeyContainerInfo;

provider.PersistKeyInCsp = false;
provider.FromXmlString(xmlString);
loadedKeys.Add(key, provider);
provider2 = provider;

We cracked open FileMon and noticed that there is a FILE NOT FOUND for that AppPool, followed by another SUCCESS for the same exact file.

I'm out of my element here, anybody have an idea as to why we're seeing this?

Answer 1

I do not have any idea about what causes the error, but instead of xml-encoding and -decoding the public-key, you could just do:

StringBuilder builder = new StringBuilder(publicKeyData);
builder.Replace("-----BEGIN CERTIFICATE-----", "");
builder.Replace("-----END CERTIFICATE-----", "");
X509Certificate2 certificate = new X509Certificate2( Convert.FromBase64String(builder.ToString()));

RSACryptoServiceProvider provider = 
  (RSACryptoServiceProvider) certificate.PublicKey.Key;

loadedKeys.Add(key, provider);
provider2 = provider;

If you are lucky, that works-around the error.