Fixing the "Keyset does not exist" error when loading a certificate in C#

If a C# application loads a certificate from the Windows machine certificate store, the certificate may be visible but the private key may still be inaccessible. I ran into this issue today, and wanted to share my tips on solving this.

Commonly, the error manifests itself in an exception, and the details often look like this:

System.Security.Cryptography.CryptographicException
  HResult=0x80090016
  Message=Keyset does not exist
  Source=System.Security.Cryptography

This can happen when the application identity does not have permission to read the private key.

For example, a Windows Service might work during local testing when it runs under your own user account, but after installation, the same service runs under a dedicated service account, and the certificate access fails.

A typical certificate lookup code with C# looks like this:

using System.Security.Cryptography;
using System.Security.Cryptography.X509Certificates;

string thumbprint = "‎1234567890ABCDEF1234567890ABCDEF12345678";
using X509Store store = new X509Store(StoreName.My, StoreLocation.LocalMachine);
store.Open(OpenFlags.ReadOnly);

X509Certificate2 certificate = store.Certificates.Find(
             X509FindType.FindByThumbprint, thumbprint,
             validOnly: false).Single();

Console.WriteLine(certificate.Subject);
Console.WriteLine(certificate.HasPrivateKey);

using RSA? privateKey = certificate.GetRSAPrivateKey();
if (privateKey is null)
{
    throw new InvalidOperationException("Certificate does not have an RSA private key.");
}

The confusing part is that HasPrivateKey may be true, but reading the private key can still fail because Windows denies access to the underlying key container.

The fix is to grant private key permissions to the identity that runs the application.

On the server:

• open certlm.msc
• go to Personal / Certificates
• find the certificate
• right-click the certificate
• select All Tasks/Manage Private Keys...
• add the Windows Service account
• grant at least read permission.

Visually, the certificate manager utility looks like this:

And the Permissions dialog box looks similar to how you'd specify NTFS file system permissions:

After configuring, restart the your application (such as, the Windows Service) and test again.

Prefer to grant access to the service account or a dedicated Windows group. Avoid granting broad private key access to Everyone or unrelated users.

This issue is easy to miss because certificate permissions and private key permissions are not the same thing. The certificate can be in the machine store and still be unusable by the application.

Good things to check:

• is the certificate in LocalMachine or CurrentUser?
• does the certificate have a private key?
• which account runs the Windows Service?
• does that account have private key read permission?
• does the code load the certificate by the expected thumbprint?

Tip: when debugging Windows Services, always test with the same identity that runs the service on the server. Local tests under your own account can hide permission problems.

For this particular error, the certificate itself was not the problem. The private key ACL was.