Question

I am getting the error “The certificate ‘CN=tempcert’ must have a private key that is capable of key exchange. The process must have access rights for the private key” when I run a WCF service on Win7 using HTTP. I change the Application Pool to use “NetworkService”. I installed the server certificate using the Local Machine. The cert is shown in the Certificate MMC under the Local Computer / Personal / Certificates. I double click on the certificate and it states that it has a private key. I then run the FindPrivateKey utility and it states that it finds the private key in C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys folder. I went into the Certificates Addin in MMC and granted full rights to the NETWORK SERVICE account. Then I went to the folder in Windows Explorer and confirmed that NETWORK SERVICE has full rights to the folder and the specific key file. However, everytime I run the WCF service it errors out that it can’t find the private key. I have no idea what else I can do.

Answer 1

You need to specify -sky exchange when you create the certificate.

makecert -sk SignedByCA -iv TempCA.pvk -n "CN=localhost" -ic 
    TempCA.cer SignedByCA.cer -sr LocalMachine -ss My -sky exchange -pe