System.Security.Cryptography.CryptographicException: Bad Data #2493

thahir · 2023-12-14T15:31:24Z

I am using Win-Acme 2.2.6 and I am trying to renew the certificate on a windows load balancer server.
But I am reciving the following error while generating the certificate could someone please let me know how it can be fixed.

** System.Security.Cryptography.CryptographicException: Bad Data.
at System.Security.Cryptography.X509Certificates.StorePal.FromBlobOrFile(ReadOnlySpan1 rawData, String fileName, SafePasswordHandle password, X509KeyStorageFlags keyStorageFlags) at System.Security.Cryptography.X509Certificates.X509Certificate2Collection.Import(ReadOnlySpan1 rawData, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
at System.Security.Cryptography.X509Certificates.X509Certificate2Collection.Import(Byte[] rawData, String password, X509KeyStorageFlags keyStorageFlags)
at PKISharp.WACS.Services.CertificateService.ParseCertificate(Byte[] bytes, String friendlyName, AsymmetricKeyParameter pk)
at PKISharp.WACS.Services.CertificateService.DownloadCertificate(AcmeOrderDetails order, String friendlyName, AsymmetricKeyParameter pk)
at PKISharp.WACS.Services.CertificateService.RequestCertificate(ICsrPlugin csrPlugin, Order order)
at PKISharp.WACS.OrderProcessor.GetFromServer(OrderContext context) **

The text was updated successfully, but these errors were encountered:

WouterTinus · 2023-12-14T20:35:33Z

See #2386 - this is probably caused by a faulty Windows Update.

robrisner · 2023-12-18T01:57:51Z

I'm getting the same error on Windows Server 2022 when trying to create a new certificate. Win-acme version v2.2.6.1571 (x64, Release).

 [VERB] [HTTP] Request completed with status OK
 [VERB] [HTTP] Response of type application/pem-certificate-chain (5703 bytes)
 [VERB] Parsing certificate from 5703 bytes received
 [VERB] Parsing PEM data at range 0..1951
 [VERB] Certificate CN=****** parsed
 [VERB] Associating private key
 [VERB] Parsing PEM data at range 1953..3778
 [VERB] Certificate C=US,O=Let's Encrypt,CN=R3 parsed
 [VERB] Parsing PEM data at range 3780..5702
 [VERB] Certificate C=US,O=Internet Security Research Group,CN=ISRG Root X1 parsed
 [EROR] Internal error parsing certificate
System.Security.Cryptography.CryptographicException: Bad Data.
   at System.Security.Cryptography.X509Certificates.StorePal.FromBlobOrFile(ReadOnlySpan`1 rawData, String fileName, SafePasswordHandle password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509Certificate2Collection.Import(ReadOnlySpan`1 rawData, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509Certificate2Collection.Import(Byte[] rawData, String password, X509KeyStorageFlags keyStorageFlags)
   at PKISharp.WACS.Services.CertificateService.ParseCertificate(Byte[] bytes, String friendlyName, AsymmetricKeyParameter pk)
 [EROR] Error requesting certificate ******
System.Security.Cryptography.CryptographicException: Bad Data.
   at System.Security.Cryptography.X509Certificates.StorePal.FromBlobOrFile(ReadOnlySpan`1 rawData, String fileName, SafePasswordHandle password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509Certificate2Collection.Import(ReadOnlySpan`1 rawData, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509Certificate2Collection.Import(Byte[] rawData, String password, X509KeyStorageFlags keyStorageFlags)
   at PKISharp.WACS.Services.CertificateService.ParseCertificate(Byte[] bytes, String friendlyName, AsymmetricKeyParameter pk)
   at PKISharp.WACS.Services.CertificateService.DownloadCertificate(AcmeOrderDetails order, String friendlyName, AsymmetricKeyParameter pk)
   at PKISharp.WACS.Services.CertificateService.RequestCertificate(ICsrPlugin csrPlugin, Order order)
   at PKISharp.WACS.OrderProcessor.GetFromServer(OrderContext context)
 [VERB] Processing order 1/1: Main

 Create certificate failed, retry? (y/n*) - no

 [EROR] Create certificate failed

WouterTinus · 2023-12-18T07:14:58Z

Most likely explained by this: https://support.microsoft.com/en-us/topic/kb5025823-change-in-how-net-applications-import-x-509-certificates-bf81c936-af2b-446e-9f7a-016f4713b46b

VBub · 2024-01-08T09:27:49Z

I was experiencing this issue myself on a windows 2022 server that is used as a remote desktop gateway. (Build 20348.2113)
I had another servers that were having no issues at all and couldn't figure it out as they all had the most recent windows updates.
Then checking the wacs version, the other server had 2.1.23.1315 and this had 2.2.6.1571
So rolling back to a 2.1 version of wacs solved the problem, I can only guess the issue is the change to .NET 7, whether that be upgrading versions has some how corrupted the data it uses, or the combination of .NET 7 with something else I do not know.

WouterTinus · 2024-01-09T07:50:18Z

Could use test with the setting UseNextGenerationCryptoApi?

VBub · 2024-01-09T10:16:28Z

UseNextGenerationCryptoApi

Setting this to true also works here's the original log vs with this setting enabled

2024-01-04 12:40:55.375 +00:00 [DBG] [HTTP] Send POST to <snip>
2024-01-04 12:40:55.375 +00:00 [VRB] [HTTP] Request content: <snip>
2024-01-04 12:40:55.561 +00:00 [VRB] [HTTP] Request completed with status "OK"
2024-01-04 12:40:55.561 +00:00 [VRB] [HTTP] Response of type application/pem-certificate-chain (5715 bytes)
2024-01-04 12:40:55.569 +00:00 [VRB] Parsing certificate from 5715 bytes received
2024-01-04 12:40:55.570 +00:00 [VRB] Parsing PEM data at range 0..1963
2024-01-04 12:40:55.584 +00:00 [VRB] Certificate CN=<snip> parsed
2024-01-04 12:40:55.590 +00:00 [VRB] Associating private key
2024-01-04 12:40:55.591 +00:00 [VRB] Parsing PEM data at range 1965..3790
2024-01-04 12:40:55.591 +00:00 [VRB] Certificate C=US,O=Let's Encrypt,CN=R3 parsed
2024-01-04 12:40:55.592 +00:00 [VRB] Parsing PEM data at range 3792..5714
2024-01-04 12:40:55.592 +00:00 [VRB] Certificate C=US,O=Internet Security Research Group,CN=ISRG Root X1 parsed
2024-01-04 12:40:55.696 +00:00 [ERR] Internal error parsing certificate
System.Security.Cryptography.CryptographicException: Bad Data.
   at System.Security.Cryptography.X509Certificates.StorePal.FromBlobOrFile(ReadOnlySpan`1 rawData, String fileName, SafePasswordHandle password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509Certificate2Collection.Import(ReadOnlySpan`1 rawData, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509Certificate2Collection.Import(Byte[] rawData, String password, X509KeyStorageFlags keyStorageFlags)
   at PKISharp.WACS.Services.CertificateService.ParseCertificate(Byte[] bytes, String friendlyName, AsymmetricKeyParameter pk)
2024-01-04 12:40:55.698 +00:00 [ERR] Error requesting certificate <snip>
System.Security.Cryptography.CryptographicException: Bad Data.
   at System.Security.Cryptography.X509Certificates.StorePal.FromBlobOrFile(ReadOnlySpan`1 rawData, String fileName, SafePasswordHandle password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509Certificate2Collection.Import(ReadOnlySpan`1 rawData, ReadOnlySpan``1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509Certificate2Collection.Import(Byte[] rawData, String password, X509KeyStorageFlags keyStorageFlags)
   at PKISharp.WACS.Services.CertificateService.ParseCertificate(Byte[] bytes, String friendlyName, AsymmetricKeyParameter pk)
   at PKISharp.WACS.Services.CertificateService.DownloadCertificate(AcmeOrderDetails order, String friendlyName, AsymmetricKeyParameter pk)
   at PKISharp.WACS.Services.CertificateService.RequestCertificate(ICsrPlugin csrPlugin, Order order)
   at PKISharp.WACS.OrderProcessor.GetFromServer(OrderContext context)
2024-01-04 12:40:55.701 +00:00 [VRB] Processing order 1/1: Main
2024-01-04 12:40:55.747 +00:00 [ERR] Renewal for <snip> failed, will retry on next run

With the setting enabled

2024-01-09 10:08:10.671 +00:00 [DBG] [HTTP] Send POST to <snip>
2024-01-09 10:08:10.671 +00:00 [VRB] [HTTP] Request content: <snip>
2024-01-09 10:08:10.799 +00:00 [VRB] [HTTP] Request completed with status "OK"
2024-01-09 10:08:10.799 +00:00 [VRB] [HTTP] Response of type application/pem-certificate-chain (3791 bytes)
2024-01-09 10:08:10.802 +00:00 [VRB] Parsing certificate from 3791 bytes received
2024-01-09 10:08:10.803 +00:00 [VRB] Parsing PEM data at range 0..1963
2024-01-09 10:08:10.803 +00:00 [VRB] Certificate CN=<snip> parsed
2024-01-09 10:08:10.804 +00:00 [VRB] Associating private key
2024-01-09 10:08:10.804 +00:00 [VRB] Parsing PEM data at range 1965..3790
2024-01-09 10:08:10.805 +00:00 [VRB] Certificate C=US,O=Let's Encrypt,CN=R3 parsed
2024-01-09 10:08:10.893 +00:00 [VRB] Parsing certificate from 3791 bytes received
2024-01-09 10:08:10.893 +00:00 [VRB] Parsing PEM data at range 0..1963
2024-01-09 10:08:10.893 +00:00 [VRB] Certificate CN=<snip> parsed
2024-01-09 10:08:10.895 +00:00 [VRB] Parsing PEM data at range 1965..3790
2024-01-09 10:08:10.897 +00:00 [VRB] Certificate C=US,O=Let's Encrypt,CN=R3 parsed
2024-01-09 10:08:10.930 +00:00 [DBG] Found 2 version(s) of the certificate
2024-01-09 10:08:10.932 +00:00 [DBG] Option 1 issued by DST Root CA X3 (thumb: 2D82938813D3078C687FD8380CA84279CBDCDAD3)
2024-01-09 10:08:10.933 +00:00 [DBG] Option 2 issued by ISRG Root X1 (thumb: 2D82938813D3078C687FD8380CA84279CBDCDAD3)
2024-01-09 10:08:10.933 +00:00 [DBG] Selected option 1
2024-01-09 10:08:10.952 +00:00 [DBG] Certificate written to cache file <snip>-temp.pfx in certificate cache folder C:\ProgramData\win-acme\acme-v02.api.letsencrypt.org\Certificates. It will be reused when renewing within 1 day(s) as long as the --source and --csr parameters remain the same and the --force switch is not used.
2024-01-09 10:08:11.033 +00:00 [VRB] Processing order 1/1: Main
2024-01-09 10:08:11.045 +00:00 [VRB] Autofac: creating PluginBackend<IStorePlugin> scope with parent PluginBackend<ICsrPlugin>
2024-01-09 10:08:11.054 +00:00 [VRB] W3SVC detected and running
2024-01-09 10:08:11.054 +00:00 [VRB] No FTPSVC detected
2024-01-09 10:08:11.098 +00:00 [DBG] Certificate store name: My
2024-01-09 10:08:11.106 +00:00 [INF] Store with CertificateStore...
2024-01-09 10:08:11.116 +00:00 [INF] Installing certificate in the certificate store

WouterTinus · 2024-01-09T12:52:38Z

I will consider making the NG option default, or at least an automatic fallback.

WouterTinus · 2024-01-23T18:45:23Z

Looked at the code but there's not really an explanation how the UseNextGenerationCryptoApi being true or false would have any effect at the point where the crash occurs. Since there are some downsides in using true as the default (e.g. certificates cannot be exported from the IIS manager, which some people love to do), I've decided not to make true the default (yet).

WouterTinus · 2024-01-23T20:02:40Z

Potential fix: now using DER instead of BER encoding.

WouterTinus · 2024-03-06T20:54:10Z

Did any of you get the chance to test version 2.2.7 or 2.2.8?

VBub · 2024-03-12T14:51:44Z

Did any of you get the chance to test version 2.2.7 or 2.2.8?

Changed one of my RDS 2022 servers over to version 2.2.8 and ran a renewal and all worked fine. Will run again on another one I know was a problem tomorrow.

akintali · 2024-03-12T17:58:29Z

I am using Win-Acme 2.2.8 and I am trying to renew the certificate.
But I am receiving the following error while generating the certificate could someone please let me know how it can be fixed.

[EROR] Internal error parsing certificate
System.Security.Cryptography.CryptographicException: Bad Data.
[EROR] Error requesting certificate
System.Security.Cryptography.CryptographicException: Bad Data.

WouterTinus · 2024-03-12T20:06:40Z

Still chasing down the exact cause of this...
I've made another attempt in this build, this time trying different key storage algorithm if the default (quite outdate one) fails: https://ci.appveyor.com/project/WouterTinus/win-acme-s8t9q/builds/49387500/artifacts

VBub · 2024-03-18T14:47:27Z

I've just tested 2.2.8 on the problem server today. All processed without issue.

Wacs version is 2.2.8.1635
Windows server build is now 2022 21H2 20348.2322 which is different since the problem. Was 20348.2113

akintali · 2024-03-18T15:21:37Z

Wacs version is 2.2.8.1635
Windows server version is 2019 and this isn't working and is still giving the error.

[EROR] Internal error parsing certificate
System.Security.Cryptography.CryptographicException: Bad Data.
[EROR] Error requesting certificate
System.Security.Cryptography.CryptographicException: Bad Data.

WouterTinus · 2024-03-18T20:01:28Z

@akintali: can you try build 1646 linked above?

akintali · 2024-03-19T12:26:24Z

@WouterTinus :I have tried with the above build 1646 but still receiving the same error.

WouterTinus · 2024-03-19T17:25:01Z

Would you mind sharing the verbose log? That might offer some hints.

akintali · 2024-03-20T10:23:02Z

[EROR] Internal error parsing certificate
System.Security.Cryptography.CryptographicException: Bad Data.
at System.Security.Cryptography.X509Certificates.StorePal.FromBlobOrFile(ReadOnlySpan1 rawData, String fileName, SafePasswordHandle password, X509KeyStorageFlags keyStorageFlags) at System.Security.Cryptography.X509Certificates.X509Certificate2Collection.Import(ReadOnlySpan1 rawData, ReadOnlySpan1 password, X509KeyStorageFlags keyStorageFlags) at System.Security.Cryptography.X509Certificates.X509Certificate2Collection.Import(Byte[] rawData, String password, X509KeyStorageFlags keyStorageFlags) at PKISharp.WACS.Services.CertificateService.ParseCertificate(Byte[] bytes, String friendlyName, AsymmetricKeyParameter pk, Int32 attempt) [EROR] Error requesting certificate <> System.Security.Cryptography.CryptographicException: Bad Data. at System.Security.Cryptography.X509Certificates.StorePal.FromBlobOrFile(ReadOnlySpan1 rawData, String fileName, SafePasswordHandle password, X509KeyStorageFlags keyStorageFlags)
at System.Security.Cryptography.X509Certificates.X509Certificate2Collection.Import(ReadOnlySpan1 rawData, ReadOnlySpan1 password, X509KeyStorageFlags keyStorageFlags)
at System.Security.Cryptography.X509Certificates.X509Certificate2Collection.Import(Byte[] rawData, String password, X509KeyStorageFlags keyStorageFlags)
at PKISharp.WACS.Services.CertificateService.ParseCertificate(Byte[] bytes, String friendlyName, AsymmetricKeyParameter pk, Int32 attempt)
at PKISharp.WACS.Services.CertificateService.ParseCertificate(Byte[] bytes, String friendlyName, AsymmetricKeyParameter pk, Int32 attempt)
at PKISharp.WACS.Services.CertificateService.DownloadCertificate(AcmeOrderDetails order, String friendlyName, AsymmetricKeyParameter pk)
at PKISharp.WACS.Services.CertificateService.RequestCertificate(ICsrPlugin csrPlugin, Order order)
at PKISharp.WACS.OrderProcessor.GetFromServer(OrderContext context)
[VERB] Processing order 1/1: Main
[INFO] Deleting existing task win-acme renew (acme.enterprise.sectigo.com) from Windows Task Scheduler.
[INFO] Adding Task Scheduler entry with the following settings
[INFO] - Name win-acme renew (acme.enterprise.sectigo.com)
[INFO] - Path D:\win-acme.v2.2.8.1646.x64.pluggable
[INFO] - Command wacs.exe --renew --baseuri "https://acme.enterprise.sectigo.com/"
[INFO] - Start at 09:00:00
[INFO] - Random delay 04:00:00
[INFO] - Time limit 02:00:00
[DBUG] Creating task to run with previously chosen credentials
[EROR] Create certificate failed
[VERB] Exiting with status code -1

Please let me know if you need any other information.

WouterTinus · 2024-03-21T19:46:49Z

Don't you see the message "Internal error, retrying with different parameters..." in the log? It's supposed be before the part that you posted.

akintali · 2024-03-26T10:57:01Z

[INFO] Downloading certificate
[DBUG] [HTTP] Send POST to https://acme.enterprise.sectigo.com/order/17bf1b10f41323526e39121600000000/cert
[VERB] [HTTP] Request content:
[VERB] [HTTP] Request completed with status OK
[VERB] [HTTP] Empty response
[VERB] Parsing certificate from 5034 bytes received
[VERB] Parsing PEM data at range 0..1967
[VERB] Certificate C=<>,ST=<>,O=<>,CN=<> parsed
[VERB] Associating private key
[VERB] Parsing PEM data at range 1968..3687
[VERB] Certificate C=<>,ST=<>,O=<>,CN=<> Private 2048bit Issuing CA parsed
[VERB] Parsing PEM data at range 3688..5033
[VERB] Certificate C=<>,ST=<>,O=<>,CN=<> Private 2048bit Root CA parsed
[WARN] Internal error, retrying with different parameters...
[VERB] Parsing certificate from 5034 bytes received (attempt 2)
[VERB] Parsing PEM data at range 0..1967
[VERB] Certificate C=<>,ST=<>,O=<>,CN=<> parsed
[VERB] Associating private key
[VERB] Parsing PEM data at range 1968..3687
[VERB] Certificate C=<>,ST=<>,O=<>,CN=<> Private 2048bit Issuing CA parsed
[VERB] Parsing PEM data at range 3688..5033
[VERB] Certificate C=<>,ST=<>,O=<>,CN=<> Private 2048bit Root CA parsed
[EROR] Internal error parsing certificate

Is this the message you were asking for? Please let me know if I am missing anything else

WouterTinus · 2024-03-27T10:20:26Z

Thanks, that's what I was looking for. Unfortunately, it doesn't solve our problem though. Two questions arise:

I noticed that you're using a Sectigo service to get certificates from and I'm wondering if something is up with the way the certificate is generated (e.g. uncommon attributes). Do you have the same issue when you get a certificate from Let's Encrypt or ZeroSSL?
Do you have anything non-standard on this server in terms of security software or group policies? E.g. FIPS compliance settings, some non-MS antivirus, etc.?

akintali · 2024-04-01T15:08:48Z

We have not tested/tried getting certificates from any other service apart from Sectigo service.
No, we do not have any non-standard security software on this server.

WouterTinus · 2024-04-03T09:06:00Z

Would you mind giving Let's Encrypt a try? That would provide an important hint as to whether this issue is certificate related or machine related.

mvue2024 · 2024-04-12T10:42:42Z

Hi @WouterTinus we also have winacme version 2.2.8.1635 on a Windows 2019 server and retrieving the certificate from Let's Encrypt but we are also getting that same Bad Data error so it looks like it is not an issue related to the certificate.

WouterTinus · 2024-04-15T18:58:36Z

I have an experimental build here that might fix the "Bad Data" issues by using a whole new way of parsing the certificate data, feedback is welcome!

https://ci.appveyor.com/project/WouterTinus/win-acme-s8t9q/builds/49620471/artifacts

WouterTinus · 2024-05-05T12:24:22Z

Any luck with the build above? @mvue2024 @akintali ?

akintali · 2024-05-06T12:49:15Z

Hello @WouterTinus .
I have used the latest build wacs version is 2.2.8.1665. But I am still facing the same error.

WouterTinus · 2024-05-06T12:51:06Z

Can you post the log output please? That might contain some hints

akintali · 2024-05-10T12:29:19Z

Hello @WouterTinus. sorry for the delay in response. Please find the attached file that has the log.

[DBUG] Logging at level Verbose
[VERB] W3SVC detected and running
[VERB] No FTPSVC detected
[VERB] Looking for settings.json in D:\win-acme.v2.2.8.1665.x64.pluggable
[DBUG] Use existing configuration folder C:\ProgramData\win-acme
[DBUG] Use existing configuration folder C:\ProgramData\win-acme\acme.enterprise.sectigo.com
[DBUG] Use existing log folder C:\ProgramData\win-acme\acme.enterprise.sectigo.com\Log
[DBUG] Use existing cache folder C:\ProgramData\win-acme\acme.enterprise.sectigo.com\Certificates
[DBUG] secrets.json not found
[DBUG] Renewal period: 55 days
[VERB] Sending e-mails False
[VERB] ExePath: D:\win-acme.v2.2.8.1665.x64.pluggable\wacs.exe
[VERB] ResourcePath: D:\win-acme.v2.2.8.1665.x64.pluggable
[VERB] PluginPath: D:\win-acme.v2.2.8.1665.x64.pluggable\

[INFO] A simple Windows ACMEv2 client (WACS)
[INFO] Software version 2.2.8.1665 (release, pluggable, standalone, 64-bit)
[INFO] Connecting to https://acme.enterprise.sectigo.com/...
[DBUG] [HTTP] Send GET to https://acme.enterprise.sectigo.com/directory
[WARN] [HTTP] Request completed with status NotFound
[VERB] [HTTP] Response of type text/plain (19 bytes)
[DBUG] Connection failed: Server returned status NotFound:Not Found
[DBUG] [HTTP] Send GET to https://acme.enterprise.sectigo.com/
[VERB] [HTTP] Request completed with status OK

[INFO] Connection OK!
[DBUG] Running with administrator credentials
[DBUG] IIS version 10.0
[INFO] Scheduled task looks healthy
[INFO] Please report issues at https://github.com/win-acme/win-acme
[VERB] Unicode display test: Chinese/語言 Russian/язык Arab/لغة
[INFO] Running in mode: Unattended
[VERB] Autofac: creating PluginFrontend scope with parent wacs
[VERB] Autofac: creating PluginFrontend scope with parent wacs
[VERB] Autofac: creating PluginFrontend scope with parent wacs
[VERB] Autofac: creating PluginFrontend scope with parent wacs
[VERB] Autofac: creating PluginFrontend scope with parent wacs
[VERB] Autofac: creating PluginFrontend scope with parent wacs
[VERB] Autofac: creating PluginBackend scope with parent wacs
[VERB] Autofac: creating Target scope with parent PluginBackend
[VERB] Autofac: creating PluginFrontend scope with parent target
[VERB] W3SVC detected and running
[VERB] No FTPSVC detected
[VERB] Autofac: creating PluginFrontend scope with parent target
[VERB] Autofac: creating PluginFrontend scope with parent target
[VERB] Autofac: creating PluginFrontend scope with parent target
[DBUG] Adding local system default as DNS server
[VERB] Autofac: creating PluginFrontend scope with parent target
[VERB] Autofac: creating PluginFrontend scope with parent target
[VERB] Autofac: creating PluginFrontend scope with parent target
[VERB] Autofac: creating PluginFrontend scope with parent target
[VERB] Autofac: creating PluginFrontend scope with parent target
[VERB] Autofac: creating PluginFrontend scope with parent target
[VERB] Autofac: creating PluginFrontend scope with parent target
[VERB] Autofac: creating PluginFrontend scope with parent target
[VERB] Autofac: creating PluginFrontend scope with parent target
[VERB] No value provided for --validationport
[VERB] No value provided for --validationprotocol
[VERB] Autofac: creating PluginFrontend scope with parent target
[VERB] Autofac: creating PluginFrontend scope with parent target
[VERB] Flag --ocsp-must-staple not present
[VERB] Flag --reuse-privatekey not present
[VERB] Autofac: creating PluginFrontend scope with parent target
[VERB] Autofac: creating PluginFrontend scope with parent target
[VERB] Autofac: creating PluginFrontend scope with parent target
[VERB] Autofac: creating PluginFrontend scope with parent target
[VERB] Autofac: creating PluginFrontend scope with parent target

[VERB] Flag --keepexisting not present
[VERB] No value provided for --acl-fullcontrol
[VERB] No value provided for --acl-read
[VERB] Autofac: creating PluginFrontend scope with parent target
[VERB] Autofac: creating PluginFrontend scope with parent target
[VERB] Autofac: creating PluginFrontend scope with parent target
[VERB] Autofac: creating PluginFrontend scope with parent target
[VERB] Autofac: creating PluginFrontend scope with parent target
[VERB] Autofac: creating PluginFrontend scope with parent target
[VERB] Autofac: creating PluginFrontend scope with parent target
[VERB] Autofac: creating PluginFrontend scope with parent target
[VERB] Autofac: creating PluginFrontend scope with parent target
[VERB] No value provided for --ftpsiteid

[VERB] Autofac: creating PluginFrontend scope with parent target
[VERB] Autofac: creating PluginFrontend scope with parent target
[VERB] Autofac: creating PluginFrontend scope with parent target
[VERB] Autofac: creating PluginFrontend scope with parent target

[VERB] Constructing ACME protocol client...
[VERB] Getting service directory...
[DBUG] [HTTP] Send GET to https://acme.enterprise.sectigo.com/directory
[WARN] [HTTP] Request completed with status NotFound
[VERB] [HTTP] Response of type text/plain (19 bytes)
[DBUG] [HTTP] Send GET to https://acme.enterprise.sectigo.com/
[VERB] [HTTP] Request completed with status OK
[VERB] [HTTP] Response content: {"newNonce":"https://acme.enterprise.sectigo.com/new-nonce","newAccount":"https://acme.enterprise.sectigo.com/new-account","newOrder":"https://acme.enterprise.sectigo.com/new-order","revokeCert":"https://acme.enterprise.sectigo.com/revoke-cert","keyChange":"https://acme.enterprise.sectigo.com/key-change","meta":{"externalAccountRequired":true}}

[DBUG] Loading signer from C:\ProgramData\win-acme\acme.enterprise.sectigo.com\Signer_v2
[DBUG] Loading account from C:\ProgramData\win-acme\acme.enterprise.sectigo.com\Registration_v2
[VERB] Using existing ACME account
[DBUG] Using default account...
[VERB] Autofac: creating Execution scope with parent wacs
[VERB] Autofac: creating PluginBackend scope with parent Execution

[VERB] Autofac: creating Split scope with parent PluginBackend
[VERB] Autofac: creating PluginBackend scope with parent Split
[INFO] Plugin Single created 1 order

[VERB] Autofac: creating Order scope with parent PluginBackend
[VERB] Autofac: creating PluginBackend scope with parent order-main
[DBUG] Reading certificate cache
[DBUG] No cache files found for renewal
[VERB] Order Main should run (new/changed source)
[VERB] Obtain order details for Main
[DBUG] Refreshing cached order
[DBUG] Refreshing order...
[DBUG] [HTTP] Send HEAD to https://acme.enterprise.sectigo.com/new-nonce
[VERB] [HTTP] Request completed with status OK
[VERB] [HTTP] Empty response
[VERB] [HTTP]

[VERB] [HTTP] Request completed with status OK
[VERB] [HTTP] Response content:

[WARN] Using cache. To force a new order within 1 days, run with --nocache. Beware that you might run into rate limits.
[VERB] Order 1/1 (Main): processing...
[DBUG]
[DBUG] in certificate cache folder C:\ProgramData\win-acme\acme.enterprise.sectigo.com\Certificates
[INFO]

[VERB] [HTTP] Request completed with status OK
[VERB] [HTTP] Empty response
[VERB] Parsing certificate from 5034 bytes received
[VERB] Parsing PEM data at range 0..1967

[VERB] Associating private key
[VERB] Parsing PEM data at range 1968..3687

[VERB] Parsing PEM data at range 3688..5033

[WARN] Internal error, retrying with different parameters...
[VERB] Parsing certificate (attempt 5034)
[VERB] Parsing PEM data at range 0..1967

[VERB] Associating private key
[VERB] Parsing PEM data at range 1968..3687

[VERB] Parsing PEM data at range 3688..5033

[EROR] Internal error parsing certificate
System.Security.Cryptography.CryptographicException: Bad Data.
at System.Security.Cryptography.X509Certificates.StorePal.FromBlobOrFile(ReadOnlySpan1 rawData, String fileName, SafePasswordHandle password, X509KeyStorageFlags keyStorageFlags) at System.Security.Cryptography.X509Certificates.X509Certificate2Collection.Import(ReadOnlySpan1 rawData, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
at System.Security.Cryptography.X509Certificates.X509Certificate2Collection.Import(Byte[] rawData, String password, X509KeyStorageFlags keyStorageFlags)
at PKISharp.WACS.Services.CertificateService.ParseCertificate(Byte[] bytes, String friendlyName, AsymmetricKeyParameter pk, Int32 attempt)
[VERB] Parsing certificate (alternative method)
[VERB] Parsing PEM data at range 0..1967
[VERB] Associating private key
[VERB] Parsing PEM data at range 1968..3687

[DBUG] certificate cache folder C:\ProgramData\win-acme\acme.enterprise.sectigo.com\Certificates. It will be reused when renewing within 1 day(s) as long as the --source and --csr parameters remain the same and the --force switch is not used.

[EROR] Error requesting certificate
System.Security.Cryptography.CryptographicException: The profile for the user is a temporary profile.
at System.Security.Cryptography.X509Certificates.StorePal.FromBlobOrFile(ReadOnlySpan`1 rawData, String fileName, SafePasswordHandle password, X509KeyStorageFlags keyStorageFlags)
at System.Security.Cryptography.X509Certificates.X509Certificate2Collection.Import(String fileName, String password, X509KeyStorageFlags keyStorageFlags)
at PKISharp.WACS.DomainObjects.CertificateInfoCache..ctor(FileInfo file, String password)
at PKISharp.WACS.Services.CacheService.FromCache(FileInfo pfxFileInfo, String password)
at PKISharp.WACS.Services.CacheService.StorePfx(Order order, CertificateOption option)
at PKISharp.WACS.Services.CertificateService.RequestCertificate(ICsrPlugin csrPlugin, Order order)
at PKISharp.WACS.OrderProcessor.GetFromServer(OrderContext context)
[VERB] Processing order 1/1: Main
[INFO] Deleting existing task win-acme renew (acme.enterprise.sectigo.com) from Windows Task Scheduler.
[INFO] Adding Task Scheduler entry with the following settings
[INFO] - Name win-acme renew (acme.enterprise.sectigo.com)
[INFO] - Path D:\win-acme.v2.2.8.1665.x64.pluggable
[INFO] - Command wacs.exe --renew --baseuri "https://acme.enterprise.sectigo.com/"
[INFO] - Start at 09:00:00
[INFO] - Random delay 04:00:00
[INFO] - Time limit 02:00:00
[DBUG] Creating task to run with previously chosen credentials
[EROR] Create certificate failed
[VERB] Exiting with status code -1

WouterTinus · 2024-05-15T08:30:08Z

Thanks, that stack trace is actually very useful because it hints at another possible cause for these issues, relating to the user profile instead of the certificate itself. Please try build 1674 for a possible resolution: https://ci.appveyor.com/project/WouterTinus/win-acme-s8t9q/builds/49817226/artifacts

akintali · 2024-05-15T11:51:13Z

@WouterTinus
The above build is working. Thanks a lot for providing us the resolution!

WouterTinus · 2024-05-17T20:34:22Z

This has been released in 2.2.9

thahir added the question label Dec 14, 2023

WouterTinus added enhancement and removed question labels Jan 9, 2024

WouterTinus added this to the 2.2.7 milestone Jan 9, 2024

WouterTinus removed this from the 2.2.7 milestone Jan 23, 2024

WouterTinus changed the title ~~I am getting the following error while generating certificate "System.Security.Cryptography.CryptographicException: Bad Data."~~ System.Security.Cryptography.CryptographicException: Bad Data Jan 23, 2024

WouterTinus added possible bug and removed enhancement labels Jan 23, 2024

WouterTinus closed this as completed Jan 23, 2024

WouterTinus reopened this Jan 23, 2024

WouterTinus added a commit that referenced this issue Mar 12, 2024

another throw at #2493

910b273

WouterTinus added a commit that referenced this issue May 15, 2024

updates #2493

c6f5a71

WouterTinus added confirmed bug and removed possible bug labels May 16, 2024

WouterTinus added this to the 2.2.9 milestone May 16, 2024

WouterTinus closed this as completed May 17, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

System.Security.Cryptography.CryptographicException: Bad Data #2493

System.Security.Cryptography.CryptographicException: Bad Data #2493

thahir commented Dec 14, 2023

WouterTinus commented Dec 14, 2023

robrisner commented Dec 18, 2023

WouterTinus commented Dec 18, 2023

VBub commented Jan 8, 2024

WouterTinus commented Jan 9, 2024

VBub commented Jan 9, 2024 •

edited

WouterTinus commented Jan 9, 2024

WouterTinus commented Jan 23, 2024

WouterTinus commented Jan 23, 2024

WouterTinus commented Mar 6, 2024

VBub commented Mar 12, 2024

akintali commented Mar 12, 2024

WouterTinus commented Mar 12, 2024

VBub commented Mar 18, 2024

akintali commented Mar 18, 2024

WouterTinus commented Mar 18, 2024

akintali commented Mar 19, 2024

WouterTinus commented Mar 19, 2024

akintali commented Mar 20, 2024

WouterTinus commented Mar 21, 2024

akintali commented Mar 26, 2024

WouterTinus commented Mar 27, 2024

akintali commented Apr 1, 2024

WouterTinus commented Apr 3, 2024

mvue2024 commented Apr 12, 2024

WouterTinus commented Apr 15, 2024

WouterTinus commented May 5, 2024

akintali commented May 6, 2024

WouterTinus commented May 6, 2024

akintali commented May 10, 2024

WouterTinus commented May 15, 2024

akintali commented May 15, 2024

WouterTinus commented May 17, 2024

System.Security.Cryptography.CryptographicException: Bad Data #2493

System.Security.Cryptography.CryptographicException: Bad Data #2493

Comments

thahir commented Dec 14, 2023

WouterTinus commented Dec 14, 2023

robrisner commented Dec 18, 2023

WouterTinus commented Dec 18, 2023

VBub commented Jan 8, 2024

WouterTinus commented Jan 9, 2024

VBub commented Jan 9, 2024 • edited

WouterTinus commented Jan 9, 2024

WouterTinus commented Jan 23, 2024

WouterTinus commented Jan 23, 2024

WouterTinus commented Mar 6, 2024

VBub commented Mar 12, 2024

akintali commented Mar 12, 2024

WouterTinus commented Mar 12, 2024

VBub commented Mar 18, 2024

akintali commented Mar 18, 2024

WouterTinus commented Mar 18, 2024

akintali commented Mar 19, 2024

WouterTinus commented Mar 19, 2024

akintali commented Mar 20, 2024

WouterTinus commented Mar 21, 2024

akintali commented Mar 26, 2024

WouterTinus commented Mar 27, 2024

akintali commented Apr 1, 2024

WouterTinus commented Apr 3, 2024

mvue2024 commented Apr 12, 2024

WouterTinus commented Apr 15, 2024

WouterTinus commented May 5, 2024

akintali commented May 6, 2024

WouterTinus commented May 6, 2024

akintali commented May 10, 2024

WouterTinus commented May 15, 2024

akintali commented May 15, 2024

WouterTinus commented May 17, 2024

VBub commented Jan 9, 2024 •

edited