如何在debian/linux上使用Asp.Net Core 2上的证书保护数据保护密钥文件

我正在尝试配置数据保护并使用证书来保护密钥文件。这里是MS文档Configuring data protection 如何在debian/linux上使用Asp.Net Core 2上的证书保护数据保护密钥文件

这里是我想要做的事：

services 
    .AddDataProtection() 
    .SetApplicationName("test server") 
    .PersistKeysToFileSystem("/home/www-data/config") 
    .ProtectKeysWithCertificate(
     new X509Certificate2("/home/www-data/config/"keyprotection.pfx);

当我启动应用程序，我得到在启动时出现以下错误：

info: Microsoft.AspNetCore.DataProtection.KeyManagement.XmlKeyManager[58] 
    Creating key {71e2c23f-448b-49c9-984f-3c8d7227c904} with 
    creation date 2017-08-29 18:53:51Z, activation date 2017-08-29 18:53:51Z, and expiration date 2017-11-27 18:53:51Z. 
info: Microsoft.AspNetCore.DataProtection.Repositories.FileSystemXmlRepository[39] 
    Writing data to file '/home/www-data/config/key-71e2c23f-448b-49c9-984f-3c8d7227c904.xml'. 
fail: Microsoft.AspNetCore.DataProtection.KeyManagement.XmlKeyManager[24] 
    An exception occurred while processing the key element '<key id="71e2c23f-448b-49c9-984f-3c8d7227c904" version="1" />'. 
System.Security.Cryptography.CryptographicException: Unable to retrieve the decryption key. 
    at System.Security.Cryptography.Xml.EncryptedXml.GetDecryptionKey(EncryptedData encryptedData, String symmetricAlgorithmUri) 
    at System.Security.Cryptography.Xml.EncryptedXml.DecryptDocument() 
    at Microsoft.AspNetCore.DataProtection.XmlEncryption.EncryptedXmlDecryptor.Decrypt(XElement encryptedElement) 
    at Microsoft.AspNetCore.DataProtection.XmlEncryption.XmlEncryptionExtensions.DecryptElement(XElement element, IActivator activator) 
    at Microsoft.AspNetCore.DataProtection.KeyManagement.XmlKeyManager.Microsoft.AspNetCore.DataProtection.KeyManagement.Internal.IInternalXmlKeyManager.DeserializeDescriptorFromKeyElement(XElement keyElement) 
warn: Microsoft.AspNetCore.DataProtection.KeyManagement.DefaultKeyResolver[12] 
    Key {71e2c23f-448b-49c9-984f-3c8d7227c904} is ineligible to be the default key because its CreateEncryptor method failed. 
System.Security.Cryptography.CryptographicException: Unable to retrieve the decryption key. 
    at System.Security.Cryptography.Xml.EncryptedXml.GetDecryptionKey(EncryptedData encryptedData, String symmetricAlgorithmUri) 
    at System.Security.Cryptography.Xml.EncryptedXml.DecryptDocument() 
    at Microsoft.AspNetCore.DataProtection.XmlEncryption.EncryptedXmlDecryptor.Decrypt(XElement encryptedElement) 
    at Microsoft.AspNetCore.DataProtection.XmlEncryption.XmlEncryptionExtensions.DecryptElement(XElement element, IActivator activator) 
    at Microsoft.AspNetCore.DataProtection.KeyManagement.XmlKeyManager.Microsoft.AspNetCore.DataProtection.KeyManagement.Internal.IInternalXmlKeyManager.DeserializeDescriptorFromKeyElement(XElement keyElement) 
    at Microsoft.AspNetCore.DataProtection.KeyManagement.DeferredKey.<>c__DisplayClass1_0.<GetLazyDescriptorDelegate>b__0() 
    at System.Lazy`1.ViaFactory(LazyThreadSafetyMode mode) 
    at System.Lazy`1.ExecutionAndPublication(LazyHelper executionAndPublication, Boolean useDefaultConstructor) 
    at System.Lazy`1.CreateValue() 
    at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyBase.get_Descriptor() 
    at Microsoft.AspNetCore.DataProtection.AuthenticatedEncryption.CngGcmAuthenticatedEncryptorFactory.CreateEncryptorInstance(IKey key) 
    at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyBase.CreateEncryptor() 
    at Microsoft.AspNetCore.DataProtection.KeyManagement.DefaultKeyResolver.CanCreateAuthenticatedEncryptor(IKey key) 
warn: Microsoft.AspNetCore.DataProtection.KeyManagement.DefaultKeyResolver[12] 
    Key {71e2c23f-448b-49c9-984f-3c8d7227c904} is ineligible to be the default key because its CreateEncryptor method failed. 
System.Security.Cryptography.CryptographicException: Unable to retrieve the decryption key. 
    at System.Security.Cryptography.Xml.EncryptedXml.GetDecryptionKey(EncryptedData encryptedData, String symmetricAlgorithmUri) 
    at System.Security.Cryptography.Xml.EncryptedXml.DecryptDocument() 
    at Microsoft.AspNetCore.DataProtection.XmlEncryption.EncryptedXmlDecryptor.Decrypt(XElement encryptedElement) 
    at Microsoft.AspNetCore.DataProtection.XmlEncryption.XmlEncryptionExtensions.DecryptElement(XElement element, IActivator activator) 
    at Microsoft.AspNetCore.DataProtection.KeyManagement.XmlKeyManager.Microsoft.AspNetCore.DataProtection.KeyManagement.Internal.IInternalXmlKeyManager.DeserializeDescriptorFromKeyElement(XElement keyElement) 
    at Microsoft.AspNetCore.DataProtection.KeyManagement.DeferredKey.<>c__DisplayClass1_0.<GetLazyDescriptorDelegate>b__0() 
    at System.Lazy`1.ViaFactory(LazyThreadSafetyMode mode) 
--- End of stack trace from previous location where exception was thrown ---

所以关键被创建并且被很好地加密。但似乎不知何故，不知道如何为它说，它解密错误：

System.Security.Cryptography.CryptographicException: 
    Unable to retrieve the decryption key.

如果我理解正确的话，它使用我提供加密密钥的证书。但是由于某种原因，它看起来并没有使用相同的证书来解密（看起来它试图从其他地方[store？]中检索它）。

什么问题？

我也试图把证书到CA存储如下所述： Create a Self-Signed Certificate and trust it on Ubuntu Linux

然后我试图找到他们从这样的代码后面：

var cert = new CertificateResolver().ResolveCertificate(CertThumbprint);

但它没有工作（它找不到它）。

我也尝试尝试使用下面的方法找到他们：

var store = new X509Store(StoreName.CertificateAuthority, 
    StoreLocation.LocalMachine); 

store.Open(OpenFlags.ReadOnly); 

var collection = store.Certificates.Find(
    X509FindType.FindByThumbprint, 
    CertThumbprint, false); 

store.Close(); 

var x509Cert = collection.Count > 0 ? collection[0] : null;

但它没有工作也没有。

那么正确的方法是什么？

来源

2017-08-29 Alexandre A.