WCF can't access local machine certificate store certificates without elevation

Question

I am having weird issue. My service certificate is stored in localMachine/Personal.

And is referenced like,

          <serviceCredentials>
            <serviceCertificate findValue="TestCertificate56" storeLocation="LocalMachine" storeName="My" x509FindType="FindByIssuerName" />
          </serviceCredentials>

When certificate is installed all seems to be working fine without needing elevation rights when running. After restarting machine, suddenly client's can no longer connect as service terminates socket on connection

System.ServiceModel.CommunicationException: The socket connection was aborted. This could be caused by an error processing your message or a receive timeout being exceeded by the remote host, or an underlying network resource issue. Local socket timeout was '00:10:00'. ---> System.Net.Sockets.SocketException: An existing connection was forcibly closed by the remote host
   at System.Net.Sockets.Socket.Receive(Byte[] buffer, Int32 offset, Int32 size, SocketFlags socketFlags)
   at System.ServiceModel.Channels.SocketConnection.ReadCore(Byte[] buffer, Int32 offset, Int32 size, TimeSpan timeout, Boolean closing)
   --- End of inner exception stack trace ---

There is no message indicating error on service side. If I run service in elevated mode, there is no issue. Also If I reinstall the certificate it works until the next restart. Also if CurrentUser store is used, no issues.

Why is this an issue? My service will be deployed and run as NetworkService user, so I believe it needs it's certificate in LocalMachine store, rather than CurrentUser store. My service won't have admin rights, so issue will re-appear in production

Edit: I replicated the issue on two different computers running VS 2017 and 2019

Answer 1

I also recommend that you use local machine storage instead of current user storage. Because when the user running the program changes, it may result in the certificate not being searchable. In addition, it is better to configure certificates through Thumbprint .

    <serviceCertificate storeLocation="LocalMachine" 
storeName="My" x509FindType="FindByThumbprint"
 findValue="974ad39ff0b86210f5e7d661e56945ad5c2d3770"/>

              </serviceCredentials>

In the end, I think the source of the problem may be that access to the public or private key of the certificate requires permissions, and I suggest that you add Everyone account to the certificate management private key group.

Feel free to let me know if the problem still exists.