I have followed the instructions here
http://msdn.microsoft.com/en-us/library/aa702621.aspx
I runnning windows 2003 IIS6 with a seperate user account for the Application pool I give this user access to the private key using cacls.exe. This works fine.
However whenever something changes with the asp.net site or IIS the permission if lost. For example if I change the web.config file. restart IIS, wait 5 hours then the call to the SSL certifiate fails and I can no longer access it from my client that is trying to consume the WFC service. I logon as the APP POOL account run the cacls.exe again and it fixes it.
How do i fix this perminatly as currently it stops every 5 hours or so.
Update
I have actually gone backwards. Now I cannot get it to work at all. These are the steps I follow
C:\FindPrivateKey>FindPrivateKey.exe Trustedpeople currentuser
Private key directory:
C:\Documents and Settings\MYUSER\Application Data\Microsoft\Crypto\RSA\S--5-21-2205538328-2105125954-533649117-1053
Private key file name:
ab715bc6d3b1ae3bdb1a9e8e21a3b851_817f45df-79ce-4f15-9345-15b5c81281a1
Give permssions
Cacls.exe "C:\Documents and Settings\MYUSER\Application Data\Microsoft\Crypto\RSA\S-1-5-21-2205538328-2105125954-533649117-1053\ab715bc6d3b1ae3bdb1a9e8e21a3b851_817f45df-79ce-4f15-9345-15b5c81281a1" /E /G "WWWTEST2\MYUSER":R
Check permissions
Cacls.exe "C:\Documents and Settings\MYUSER\Application Data\Microsoft\Crypto\RSA\S-1-5-21-2205538328-2105125954-533649117-1053\ab715bc6d3b1ae3bdb1a9e8e21a3b851_817f45df-79ce-4f15-9345-15b5c81281a1"
Everyone:R
WWWTEST2\MYUSER:F
Set owner
subinacl /file "C:\Documents and Settings\MYUSER\Application Data\Microsoft\Crypto\RSA\S-1-5-21-2205538328-2105125954-533649117-1053\ab715bc6d3b1ae3bdb1a9e8e21a3b851_817f45df-79ce-4f15-9345-15b5c81281a1" /setowner=WWWTEST2\MYUSER
Error I get from asp.net site trying to consume the sevice
Exception: System.InvalidOperationException
Message: Cannot find the X.509 certificate using the following search criteria: StoreName 'TrustedPeople', StoreLocation 'CurrentUser', FindType 'FindByThumbprint', FindValue 'b33e04f057a52cb73007aec81eee86d2f75e3c69'.
Source: System.ServiceModel
at System.ServiceModel.Security.SecurityUtils
When I login as MYUSER the account running the IIS app pool and go to "mmc" cetertifates snap in I can see the certificate in My User account under TrustedPeople
UPDATE
I was able to get it working by installing the cert on Local Machine / Personal and using winhttpcertcfg instead of cacls