本地IIS与IIS Express下ASP.NET WebForms数字签名异常排查

我开发的基于DevExpress库的ASP.NET WebForms文档数字签名应用，在本地IIS部署时抛出「Exception has been thrown by the target of an invocation」异常，内部异常为「invalid flags」；但在IIS Express环境下运行完全正常。

已联系DevExpress技术支持，对方表示问题并非直接源于其组件，签名操作依赖标准System.Security.Cryptography命名空间，异常由该类库抛出。搜索发现多个IIS与System.Security.Cryptography相关的类似问题，但仍未定位原因。异常恰好触发在PIN输入对话框即将弹出的时刻，推测是权限或配置问题，特附上相关代码及完整异常栈信息，请求协助排查。

相关代码 #

public bool signPdf(X509Certificate2 selectedCertificate, string locationParam, string contactInfoParam, string reasonParam, string sourcePath, string destPath)
{
    try
    {
        string PomName = "";
        string PomGreska = "";
        string sourcePathFixed = Razno.FixPath(sourcePath);
        string destPathFixed = Razno.FixPath(destPath);

        Stream inter = new MemoryStream();

        using (var signer = new PdfDocumentSigner(sourcePathFixed))
        {
            HashAlgorithmType hashAlgorithmToBeUsed = HashAlgorithmType.SHA256;

            switch (selectedCertificate.SignatureAlgorithm.FriendlyName.ToUpper())
            {
                case "SHA1RSA":
                    hashAlgorithmToBeUsed = HashAlgorithmType.SHA1;
                    break;
                case "SHA256RSA":
                    hashAlgorithmToBeUsed = HashAlgorithmType.SHA256;
                    break;
                case "SHA384RSA":
                    hashAlgorithmToBeUsed = HashAlgorithmType.SHA384;
                    break;
                case "SHA512RSA":
                    hashAlgorithmToBeUsed = HashAlgorithmType.SHA512;
                    break;
                default:
                    hashAlgorithmToBeUsed = HashAlgorithmType.SHA256;
                    break;
            }

            Pkcs7Signer pkcs7Signature = new Pkcs7Signer(selectedCertificate, hashAlgorithmToBeUsed, null, null, null, PdfSignatureProfile.PAdES_BES);
            var newSignature = new PdfSignatureBuilder(pkcs7Signature);

            Sertifikati s = new Sertifikati();
            newSignature.Location = s.GetLocationFromSubject(selectedCertificate.Subject);
            newSignature.Name = s.GetContactInfoFromSubject(selectedCertificate.Subject);
            newSignature.Reason = reasonParam;
            Sertifikati.SubjectNameFromCert(selectedCertificate, ref PomName, ref PomGreska);

            string contactInfoValue = contactInfoParam;
            if (String.IsNullOrEmpty(contactInfoValue)) contactInfoValue = PomName;
            newSignature.ContactInfo = contactInfoValue;
            signer.SaveDocument(inter, newSignature);
        }

        using (var fileStream = File.Create(destPathFixed))
        {
            inter.Seek(0, SeekOrigin.Begin);
            inter.CopyTo(fileStream);
        }

        return true;
    }
    catch (Exception e)
    {
        EventLogManager.WriteToEventLogInformation("DigitalSignature", "Application", "Errir ih method signPdfWithoutTimestamp : " + e.Message);
        return false;
    }
}

完整异常栈信息 #

Exception.Message:
 Exception has been thrown by the target of an invocation.

Exception.StackTrace:
  at System.RuntimeMethodHandle.InvokeMethod(Object target, Object[] arguments, Signature sig, Boolean constructor)
   at System.Reflection.RuntimeMethodInfo.UnsafeInvokeInternal(Object obj, Object[] parameters, Object[] arguments)
   at System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   at DevExpress.Pdf.Pkcs7Signer.RSACngSignatureHelper.SignDigest(Byte[] digest)
   at DevExpress.Pdf.Pkcs7SignerBase.CreateSignature(Byte[] dataDigest, String hashOid)
   at DevExpress.Pdf.Native.DocumentSigning.PdfSignatureModelObject.PatchStream(PdfBinaryWriter writer, Boolean resetGeneration)
   at DevExpress.Pdf.PdfDocumentSigner.SaveDocument(Stream stream, PdfSignatureBuilder[] signatures)
   at Osa.Unidocs.ElektronskiPotpisStandardModul.PdfDevExpressSigning.signPdf(X509Certificate2 selectedCertificate, String locationParam, String contactInfoParam, String reasonParam, String sourcePath, String destPath) 

Exception.Source:
  mscorlib

Exception.InnerException.Message:
 Invalid flags.

Exception.InnerException.StackTrace:
   at System.Security.Cryptography.NCryptNative.SignHash[T](SafeNCryptKeyHandle key, Byte[] hash, T& paddingInfo, AsymmetricPaddingMode paddingMode, NCryptHashSigner`1 signer)
   at System.Security.Cryptography.NCryptNative.SignHashPkcs1(SafeNCryptKeyHandle key, Byte[] hash, String hashAlgorithm)
   at System.Security.Cryptography.RSACng.SignHash(Byte[] hash, HashAlgorithmName hashAlgorithm, RSASignaturePadding padding)

Exception.InnerException.Source:
  System.Core

内容的提问来源于stack exchange，提问作者Andrijana Stosevski