Troubleshooting: OAuth2/OIDC RSA Signing Fails With 'Key Not Valid for Use in Specified State' Error

Version Affected: All
 
 

Overview

An OAuth2/OpenID Connect (OIDC) realm configured with the RSA signing algorithm can fail while HMAC signing continues to work fine, with the realm's debug.log showing a cryptographic exception:

System.Security.Cryptography.CryptographicException: Key not valid for use in specified state.

There are multiple potential causes:

• See Cause 1 - The signing certificate's private key is not marked exportable
• See Cause 2 - The application pool identity does not have permission to access the signing certificate's private key

These causes are not related, so a fix for one cause will not resolve the other.

 

In this article

• Cause 1: Signing Certificate's Private Key Is Not Marked Exportable
• Cause 2: Application Pool Identity Lacks Permission to the Private Key

Cause 1: Signing Certificate's Private Key Is Not Marked Exportable

This is likely because the private key is not marked as exportable in the Windows certificate store.

Resolution 1:

Test by either using a certificate with an exportable private key, or re-importing the current certificate with the option for the private key to be exportable selected. Note that actually exporting the private key is not required -- the certificate in the Certificate console just needs to already have this capability, meaning that when the certificate is right-clicked and All Tasks > Export is selected, the option Yes, export the private key should be available to select. If it isn't, locate and import another certificate that has this option enabled.

Cause 2: Application Pool Identity Lacks Permission to the Private Key

The signing certificate's private key is exportable, but the identity that needs to read it (typically IIS AppPool\SecureAuth0Pool or Network Service) does not have permission to, which produces the same error.

Resolution 2:

1. On the IdP server, open the Certificates MMC snap-in for the Local Computer (certlm.msc) and locate the signing certificate.
2. Right-click the certificate and select All Tasks > Manage Private Keys.
3. Add the identity that needs to read the key and grant it Read access. Which identity this is depends on which component is using the certificate:
   • For an OAuth2/OIDC realm, this is typically the realm's application pool identity (IIS AppPool\SecureAuth0Pool).
   • For a SAML SP-Initiated realm signing its own response, this is typically NETWORK SERVICE -- plus Authenticated Users as well, if the realm uses SSO or Integrated Windows Authentication (IWA).
4. Click OK, then recycle the application pool (or restart IIS) and test again.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.