Cannot import the keyfile 'blah.pfx' - err

Question

We just upgraded our Visual Studio 2008 projects to Visual Studio 2010. All of our assemblies were strong signed using a Verisign code signing certificate. Since the upgrade we continuously get the following error:

Cannot import the following key file: companyname.pfx. The key file may be password protected. To correct this, try to import the certificate again or manually install the certificate to the Strong Name CSP with the following key container name: VS_KEY_3E185446540E7F7A

This happens on some developer machines and not others. Some methods used to fix this that worked some of the time include:

• Re-installing the key file from Windows Explorer (right click on the PFX file and click Install)
• Installing Visual Studio 2010 on a fresh machine for the first time prompts you for the password the first time you open the project, and then it works. On machines upgraded from Visual Studio 2008, you don't get this option.

I've tried using the SN.EXE utility (Strong Name Tool) to register the key with the Strong Name CSP as the error message suggests, but whenever I run the tool with any options using the version that came with Visual Studio 2010, SN.EXE just lists its command line arguments instead of doing anything. This happens regardless of what arguments I supply.

Why is this happening, and what are clear steps to fix it? I'm about to give up on ClickOnce installs and Microsoft code signing.

Answer 1

I had the same issue and deleting the store and reading didn't work. I had to do the following.

• Get a copy of OpenSSL. It is available for Windows. Or use a Linux box as they all pretty much all have it.

• Run the following to export to a key file:

  openssl pkcs12 -in certfile.pfx -out backupcertfile.key
  
  openssl pkcs12 -export -out certfiletosignwith.pfx -keysig -in backupcertfile.key
  

Then in the project properties you can use the PFX file.

Answer 2

I spoke too soon! Rebuild brought the errors back into play...

I found this works - right click in Solution Explorer and exclude it from the project. Click Show all files, right click and now include it in the project again. Now undo pending changes...

For some reason this sorted it out for me and was relatively painless!

Answer 3

I found that in some cases you should try to delete this key before you install it. So do the following:

1. sn -d VS_XXXX
2. sn -i mykey.pfx VS_XXX

Answer 4

This Solved my problem: Open your VS Project

Double click on Package.appxmanifest

Go to Packaging tab

click choose certificate

click configure certificate

select from file and use example.pfx that unity or anything else created

Answer 5

I was running into this problem as well. I was able to resolve the issue by running
sn -i <KeyFile> <ContainerName> (installs key pair into a named container).

sn is usually installed as part of a Windows SDK. For example C:\Program Files (x86)\Microsoft SDKs\Windows\v8.0A\bin\NETFX 4.0 Tools\sn.exe. Most likely this location is not on the search path for your standard environment. However, the "Developer Command Prompt" installed by Visual Studio adds additional information that usually includes the correct location.

Based on your post that would look like

sn -i companyname.pfx VS_KEY_3E185446540E7F7A

This must be run from the location of your PFX file, if you have the solution loaded in VS 2010 you can simply right click on the pfx file from the solution explorer and choose Open Command Prompt which will launch the .net 2010 cmd prompt tool in the correct directory.

Before running this sn command I did re-install the pfx by right clicking on it and choosing install however that did not work. Just something to note as it might be the combination of both that provided the solution.

Hope this helps solve your problem.

Answer 6

I had a similar issue, but after selecting the pfx in a "Strong name key file" ComboBox and typing the password I still got a similar error (without the container name part):

Cannot import the following key file: companyname.pfx. The key file may be password protected. To correct this, try to import the certificate again or manually install the certificate

Also, the "Sign the ClickOnce manifests" certificate information panel wasn't populated.

I did "Select from File..." on my pfx, and it solved the problem.