X509Certificate2崩溃IIS

Question

这是打破IIS的代码，做研究后，我发现下面的职位 X509Certificate2 makes IIS crash它固定我的问题

 var cert = new X509Certificate2(); 
     cert.Import(Resources.wildcard, "xxx", X509KeyStorageFlags.Exportable); 

固定的代码

 var cert = new X509Certificate2(); 
     cert.Import(Resources.wildcard, "xxx", X509KeyStorageFlags.MachineKeySet | X509KeyStorageFlags.Exportable); 

但是现在这个原因我的签名抛出以下异常

n exception of type 'System.Security.Cryptography.CryptographicException' occurred in mscorlib.dll but was not handled in user code 
Additional information: Invalid provider type specified. 

我的代码

public class RsaSha1 
{ 
    private readonly X509Certificate2 _certificate; 

    public RsaSha1(X509Certificate2 certificate) 
    { 
     _certificate = certificate; 
    } 

    public string Sign(string signatureBaseString) 
    { 
     return SignCore(signatureBaseString); 
    } 

    string SignCore(string baseString) 
    { 
     using (var hash = Hash(baseString)) 
     { 
      return Base64Encode(Sign(hash)); 
     } 
    } 

    private static string Base64Encode(byte[] signature) 
    { 
     return Convert.ToBase64String(signature); 
    } 


    private byte[] Sign(SHA1CryptoServiceProvider hash) 
    { 
     var formatter = new RSAPKCS1SignatureFormatter(_certificate.PrivateKey). 
      Tap(it => it.SetHashAlgorithm("MD5")); 
    //The line above throws the Exception if X509KeyStorageFlags.MachineKeySet is added, 
    //but without X509KeyStorageFlags.MachineKeySet my application works in a console application (stress testing) but not in IIS (in a web application) 
     return formatter.CreateSignature(hash); 
    } 

    SHA1CryptoServiceProvider Hash(string signatureBaseString) 
    { 
     var sha1 = new SHA1CryptoServiceProvider(); 

     var bytes = Encoding.ASCII.GetBytes(signatureBaseString); 

     using (var crypto = new CryptoStream(Stream.Null, sha1, CryptoStreamMode.Write)) 
     { 
      crypto.Write(bytes, 0, bytes.Length); 
     } 

     return sha1; 
    } 
} 

编辑1： 新的信息，似乎当我添加X509KeyStorageFlags.MachineKeySet然后_certificate.PrivateKey会抛出异常，但是当我删除X509KeyStorageFlags.MachineKeySet那么IIS就会崩溃。 PS我使用从startssl如果

Answer 1

生成的证书我将证书导入到了LOCALMACHINE商店（不是通过代码） 然后在我的软件，我改变

var cert = new X509Certificate2(); 
    cert.Import(Resources.wildcard, "xxx", X509KeyStorageFlags.MachineKeySet | X509KeyStorageFlags.Exportable); 

到

 X509Store store = new X509Store(StoreName.My, StoreLocation.LocalMachine); 
     store.Open(OpenFlags.ReadOnly); 
     foreach (X509Certificate2 certificate in store.Certificates) 
     { 
      if (certificate.SubjectName.Name != null && certs.SubjectName.Name.Contains("*.domain.xxx")) 
      { 
       cert = certificate; 
      } 
     } 

这似乎比从文件加载证书更好地工作，并且它在加载时不会中断IIS