Access Denied in WindowsSecureMimeContext.Import when running under Azure Web Service

[xtomas]

Hello Jeff,

I've got problem in WindowsSecureMimeContext.Import method. It causes "Access Denied" error when our ASP.NET app is running under Azure App Service. In method is X509Store AddressBook used for ReadWrite. May be it's not possible to add certificates into X509Store when app is running under Azure App Service.

What I need is to verify IDigitalSignature under WindowsSecureMimeContext.

My code fragment (where context is based on WindowsSecureMimeContext class).

// verify signature
foreach (var signature in signedMultipart.Verify(context))
{
    try
    {
        signature.Verify();
    }
    catch (DigitalSignatureVerifyException e)
    {
        throw new VerificationFailedException(e, "Signature verification failed", e.Message);
    }
}

Exception:

System.Security.Cryptography.CryptographicException: Access is denied.

   at System.Security.Cryptography.X509Certificates.X509Store.Add(X509Certificate2 certificate)
   at MimeKit.Cryptography.WindowsSecureMimeContext.Import(X509Certificate certificate)
   at MimeKit.Cryptography.SecureMimeContext.GetDigitalSignatures(CmsSignedDataParser parser)
   at MimeKit.Cryptography.SecureMimeContext.Verify(Stream content, Stream signatureData)
   at MimeKit.Cryptography.MultipartSigned.Verify(CryptographyContext ctx)

I there any way how to verify signature without adding any cetificate into certificate key store?

Tomas

[jstedfast]

I'll add a try/catch around the Import so if it fails it doesn't prevent the verification process

[xtomas]

Thank you for fast fix 👍