Windows Server 2022中pbeWithSHA1And40BitRC2-CBC证书签名JWT报错

问题背景 #

尝试使用数据库中存储的受密码保护的Base64格式证书对JWT进行签名，代码在Windows Server 2012上运行正常，但迁移到Windows Server 2022后抛出Invalid provider type specified异常。

相关代码 #

//Load certificate
var certificate = new X509Certificate2(certificateBytes, password, X509KeyStorageFlags.MachineKeySet | X509KeyStorageFlags.Exportable);

//Make header, add signing certificate
var header = new JwtHeader(new X509SigningCredentials(certificate));
header.Add(JwtHeaderParameterNames.X5c, new string[] { Convert.ToBase64String(certificate.RawData) });

//Make payload
var payload = new JwtPayload(issuer, audience, claimes, notBefore: null, expires);

//Make token and sign
var token = new JwtSecurityToken(header, payload);

//Serialize
var tokenHandler = new JwtSecurityTokenHandler();
return tokenHandler.WriteToken(token);

异常堆栈 #

at System.Security.Cryptography.Utils.CreateProvHandle(CspParameters parameters, Boolean randomKeyContainer)                          
at System.Security.Cryptography.Utils.GetKeyPairHelper(CspAlgorithmType keyType, CspParameters parameters, 
Boolean randomKeyContainer, Int32 dwKeySize, SafeProvHandle& safeProvHandle, SafeKeyHandle& safeKeyHandle)                          
at System.Security.Cryptography.RSACryptoServiceProvider.GetKeyPair()                          
at System.Security.Cryptography.RSACryptoServiceProvider..ctor(Int32 dwKeySize, CspParameters parameters, Boolean useDefaultKeySize)                          
at System.Security.Cryptography.X509Certificates.X509Certificate2.get_PrivateKey()                          
at System.Security.Cryptography.X509Certificates.RSACertificateExtensions.GetRSAPrivateKey(X509Certificate2 certificate)                          
at Microsoft.IdentityModel.Tokens.X509SecurityKey.get_PrivateKey()                         
at Microsoft.IdentityModel.Tokens.X509SecurityKey.get_PrivateKeyStatus()                          

at Microsoft.IdentityModel.Tokens.AsymmetricSignatureProvider..ctor(SecurityKey key, String algorithm, Boolean willCreateSignatures)                         
at Microsoft.IdentityModel.Tokens.CryptoProviderFactory.CreateSignatureProvider(SecurityKey key, String algorithm, Boolean willCreateSignatures, Boolean cacheProvider)       
at Microsoft.IdentityModel.Tokens.CryptoProviderFactory.CreateForSigning(SecurityKey key, String algorithm, Boolean cacheProvider)                         
at Microsoft.IdentityModel.JsonWebTokens.JwtTokenUtilities.CreateEncodedSignature(String input, SigningCredentials signingCredentials)                      
at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.WriteToken(SecurityToken token)

证书信息 #

• MAC: sha1, Iteration 1024
• MAC length: 20, salt length: 20
• PKCS7 Data
• Shrouded Keybag: pbeWithSHA1And3-KeyTripleDES-CBC, Iteration 1024

问题原因 #

Windows Server 2022默认禁用了旧版加密算法和CSP（加密服务提供程序），而当前证书使用的pbeWithSHA1And3-KeyTripleDES-CBC属于过时算法，同时证书加载时的密钥存储标志配置会触发系统尝试使用已被弃用的CSP，最终导致异常。

解决方案 #

方案1：修改证书加载的KeyStorageFlags #

在加载证书时添加EphemeralKeySet标志，强制使用CNG（下一代加密技术）提供程序，避免依赖旧CSP：

var certificate = new X509Certificate2(
    certificateBytes, 
    password, 
    X509KeyStorageFlags.MachineKeySet | X509KeyStorageFlags.Exportable | X509KeyStorageFlags.EphemeralKeySet
);

EphemeralKeySet会将密钥仅保留在内存中，不写入磁盘，同时优先调用CNG实现，适配Windows Server 2022的安全策略。

方案2：显式使用CNG RSA实例加载私钥 #

如果方案1无效，可手动将证书私钥转换为CNG的RSA实例，绕过旧的RSACryptoServiceProvider：

// 加载证书
var certificate = new X509Certificate2(certificateBytes, password, X509KeyStorageFlags.MachineKeySet | X509KeyStorageFlags.Exportable);

// 显式获取CNG RSA私钥
using var rsa = certificate.GetRSAPrivateKey() as RSA;
if (rsa == null)
{
    throw new InvalidOperationException("证书不包含RSA私钥");
}

// 使用CNG RSA创建签名凭据
var signingCredentials = new SigningCredentials(
    new RsaSecurityKey(rsa), 
    SecurityAlgorithms.RsaSha256
);

// 后续JWT创建逻辑不变
var header = new JwtHeader(signingCredentials);
header.Add(JwtHeaderParameterNames.X5c, new string[] { Convert.ToBase64String(certificate.RawData) });
// ... 其余代码保持一致

方案3：更新证书加密算法（长期推荐） #

旧的pbeWithSHA1And3-KeyTripleDES-CBC算法安全性较低，Windows Server 2022对其限制严格。建议重新生成证书，使用更安全的算法组合：

• 哈希算法采用SHA256及以上版本
• 私钥保护使用AES-256等现代加密算法
  替换数据库中的旧证书后，可从根源解决兼容性和安全性问题。

内容的提问来源于stack exchange，提问作者sam it