View source for Error "The specified network password is not correct." or "The requested key container was not found."

[[Category:Troubleshooting]]
= Symptoms =
In a program written with QuickOPC, you receive an error with message text "The specified network password is not correct.", possibly followed by "+ The SDK action called was
"ApplicationInstance.CheckApplicationInstanceCertificate"", and it is impossible to connect to any OPC UA server. It may be possible to circumvent the error by always running the program with elevated privileges (not just when it is creating the application certificate), but that is not a solution in many cases.

The error text may be localized, for example:
;German: Das angegebene Netzwerkkennwort ist falsch.

In .NET, this error is the innermost .NET exception of type System.Security.Cryptography.CryptographicException, with HResult 0x80070056 (-2147024810). It is normally wrapped in a UAEngineException with message text like "UA SDK error (System.Security.Cryptography.CryptographicException) in 'ApplicationInstance.CheckApplicationInstanceCertificate'. The specified network password is not correct.".

= Cause =
QuickOPC uses OPC Foundation code for certificate operations (in this case, it is usually the creation of the application instance certificate for the client). The code makes temporary copies of PFX certificates with private keys in a key container, because all private keys used for cryptography operations must be in some key container. Write access to the container is therefore needed, but it is missing on the computer that manifests the error.

= Resolution =
In order to resolve the issue, give Write permissions to the <code>C:\ProgramData\Microsoft\Crypto\RSA</code> folder.

Texts in parenthesis are for German Windows.
#In Windows '''File Explorer''', navigate to <code>C:\ProgramData\Microsoft\Crypto\RSA</code> . Note: The <code>ProgramData</code> folder is hidden; your '''File Explorer''' needs to be set to show hidden files and folders.
#Right-click on the {{Style=item|MachineKeys}} folder, and select the {{Style=menu|Properties}} ({{Style=menu|Eigenschaften}}) command.
#In the {{Style=label|MachineKeys Properties}} ({{Style=label|Eigenschaften von MachineKeys}}) dialog, switch to the {{Style=label|Security}} ({{Style=label|Sicherheit}}) tab.
#Press the {{Style=button|Advanced}} ({{Style=button|Erweitert}}) button.
#In the {{Style=label|Advanced Security Settings for MachineKeys}} ({{Style=label|Erweiterte Sicherheitseinstellungen für "MachineKeys"}})  dialog, press the {{Style=button|Change permissions}} ({{Style=button|Berechtigungen ändern}}) button.
#Press the {{Style=button|Disable inheritance}} ({{Style=button|Vererbung deaktivieren}}) button, and confirm the default selection, which is to convert the inherited permissions into explicit permissions.
#Back in the {{Style=label|Advanced Security Settings for MachineKeys}} ({{Style=label|Erweiterte Sicherheitseinstellungen für "MachineKeys"}})  dialog, select the row with permission entries for {{Style=item|Everyone}} ({{Style=item|Jeder}}), and press the {{Style=button|Edit}} ({{Style=button|Bearbeiten}}) button.
#In the {{Style=label|Permission Entry for MachineKeys}} ({{Style=label|Berechtigungseintrag für "MachineKeys"}}) dialog, under the {{Style=label|Basic  permissions}} ({{Style=label|Grundlegende Berechtigungen}}), enable the checkbox next to the {{Style=label|Write}} ({{Style=label|Schreiben}})  permission.
#Press {{Style=button|OK}} to close the {{Style=label|Permission Entry for MachineKeys}} ({{Style=label|Berechtigungseintrag für "MachineKeys"}}) dialog.
#Press {{Style=button|OK}} to close the {{Style=label|Advanced Security Settings for MachineKeys}} ({{Style=label|Erweiterte Sicherheitseinstellungen für "MachineKeys"}})  dialog.
#Press {{Style=button|OK}} to close the {{Style=label|MachineKeys Properties}} ({{Style=label|Eigenschaften von MachineKeys}}) dialog.

= More information =
The recommended resolution may have security implications and it is up to you to assess their impact. QuickOPC, however, cannot work without the Write permission to the specified key container. The steps outlined in the solution give this permission to the Everyone group, because that is how it is set on "normal" Windows installations that we have observed. It might be possible to limit it to just the user(s) that is/are running the application.

On most new Windows installations, the Write permission on the affected key container is already granted. Around some time in year 2019, we started getting reports from customers about "The specified network password is not correct." error on some computers. It has not been determined so far why the default settings on these computers are different.

Internally, “Invalid provider type specified” CryptographicException normally precedes this error; however, this first exception is not directly propagated to the user code.

= See also =
https://stackoverflow.com/questions/22581811/invalid-provider-type-specified-cryptographicexception-when-trying-to-load-pri

https://docs.microsoft.com/en-US/troubleshoot/windows-server/windows-security/default-permissions-machinekeys-folders