Problems with CrytoAPI

nikhilhs · Post by **nikhilhs** » Fri Feb 04, 2005 1:13 pm

I'm getting the "CryptoAPI cryptographic service provider (CSP) for this implementation could not be acquired." error. I've checked that MS\Crypto|RSA\MachineKeys has full permissions for everyone. However, there's nothing inside that folder. I'm running IIS 6.0 on Windows Server 2003. This is not an upgrade from Windows 2000.

If I try to login from the same computer, it works fine. It fails when I try to login from other computers.

If there's a way to remove the encryption, I'll do that to get this working. Security is not an issue.

Post by **jeremy_sg** » Fri Feb 04, 2005 3:02 pm

Some general questions,

1. What version of Vault are you using?

2. Is the MachineKeys directory of the client machine read/write by the user who is running the Vault client?

nikhilhs · Post by **nikhilhs** » Sun Feb 06, 2005 11:12 pm

1. Version 3.0.2
2. Yes

Right now, security is not an issue. Is there a way to disable the encryption requirement until this problem is fixed?

Post by **jeremy_sg** » Tue Feb 08, 2005 10:46 am

Does this error message appear in the server logs or in a popup in the client? When the problem is on the server side, the client will report "could not get public key from server", and when the problem is on the client side, the error message is the one that you posted. Can you try giving everyone full control of the machinekeys directory on the client machine and delete the "edb3...." file in the machinekeys directory on the client machine.

nikhilhs · Post by **nikhilhs** » Tue Feb 08, 2005 12:20 pm

The exact error message is "CryptoAPI cryptographic service provider (CSP) for this implementation could not be acquired." and it pops up on the client when I attempt to login. I'm at username\Application Data\Microsoft\Crypto\RSA and there is no folder names Machine Keys. The clients are running Windows 2000 and XP. There is a folder with a string of characters. There is no edb3.

-Nick

Post by **jeremy_sg** » Tue Feb 08, 2005 12:44 pm

The problem could be that you aren't running service pack 3 of Windows 2000, which is needed for the security used by Vault.

nikhilhs · Post by **nikhilhs** » Tue Feb 08, 2005 1:55 pm

I have service pack 4 on Windows 2000. What would cause this problem with Windows XP?

Post by **jeremy_sg** » Tue Feb 08, 2005 2:05 pm

Perhaps the problem is that you are looking at username\application data, but you should be looking at %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys.

Does the MachineKeys directory exist there? Is it read/write for the user running Vault?

nikhilhs · Post by **nikhilhs** » Wed Feb 16, 2005 2:49 pm

I've given all permissions to everyone. Is there a way to just disable the encryption?

-Nick

Post by **jeremy_sg** » Wed Feb 16, 2005 2:55 pm

Email me with your phone number, and I'll see if we can figure this out.

MK · Post by MK » Tue Mar 29, 2005 2:42 am

I have almost the same problem. As I try to log in Vault (either from VS IDE or Vault Client), I get the following message: "CryptoAPI cryptographic service provider (CSP) for this implementation could not be acquired"...

Environment:

1. Vault Server and Clinent both v. 3.0.5
2. WinXP Pro SP2
3. I have administrative provileges on the PC
4. Full control permisions granted to Everybody for "N:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys"

That happened when I uninstalled VMWare 5 Beta. Installing it back did not help, only rollback to the restore point before VMWare uninstallation helped.

A day later the Vault Client gave the same error, while MS VS .NET 2003 IDE continued to work with already connected server without any problems. As soon as I restarted VS .NET IDE, it reported the same error.

But if I run Vault Client as another user (either logged in as another user, or run VaultClientGUI.exe as another user using "Run as..." commmand), the client works fine.

What could be the problem and how to solve it?

Post by **jeremy_sg** » Tue Mar 29, 2005 6:32 am

The problem is that the user you're logged in as doesn't have full control to the client's MachineKeys directory. Also, if you're still getting problems, delete the file that starts with "edb3...." in the client's machinekeys directory.

MK · Post by MK » Tue Mar 29, 2005 7:57 am

I gave full control to Everybody to the MachineKeys folder.

The user I use to login is a member of the local Administrators group.

There is no file, which starts with "edb3..." in the MachineKeys folder.

The only solution, which I could find is permanent swapping from one user account to another, with deleting the non-working user profile from the system.

Post by **jeremy_sg** » Tue Mar 29, 2005 10:46 am

I'm sorry that it came down to such a drastic solution. I really want to figure out why some users can't get the cryptoAPI stuff to work when it seems like it should.