无法使用指纹从 asp.net core 2.1 访问 X509Store 中的证书

Question

I have strange problem when accessing X509Store from IIS. I can't look them up.
If I access both the rp cert and ca cert from powershell both are there,

dir cert: -Recurse | Where-Object { $_.Thumbprint -like " thumprintstring " }

I have checked that the thumbprints don't have a hidden char in the beginning of thumbprint
I have set that the certificates are exportable when I install them
I have for the moment set it accessable for everyone(its a certificate to a test server) in certficate store

This is code I use

                StoreLocation location = certificateConfig.UseCurrentUserStoreLocation ? StoreLocation.CurrentUser : StoreLocation.LocalMachine;
 
                using (var clientCertStore = new X509Store(StoreName.My, location))
                {
                    clientCertStore.Open(OpenFlags.ReadOnly);

                    //Search for the client cert
                    X509Certificate2 rpCert = GetCertByThumbprint(clientCertStore, certificateConfig.RpCertThumbprint);
                    if (rpCert == null)
                    {
                        throw new InvalidOperationException("No rp cert found for specified thumbprint #" + certificateConfig.RpCertThumbprint +"# "+location);
                    }
                    ClientCertificates.Add(rpCert);
                }
<snip>
        private X509Certificate2 GetCertByThumbprint(X509Store certStore, string thumbprint)
        {
            var certs = certStore.Certificates.Find(X509FindType.FindByThumbprint, thumbprint, false);

            return certs.Count > 0 ? certs[0] : null;
        }

The rpcert is always null whatever i try.
Do I need another way to open up the store from IIS?
Any ideas or suggestions? What am I missing?

Answer 1

The problem was not what I expected. The config read from enviromentvariables that had been deleted so they didnt show in enviromentvariables and the server had not been restarted. And the deleted ones had most likely the bad character infront of the thumbprint. Restarting iis doesn't solve this since the network service account doesnt reread these when already loggedon.

Follow up question: Is possible to relogin in network service account without restarting the server?