Azure App Service (East US) unable to access private key for uploaded certificate – "Keyset does not exist"

Question

Summary

We are experiencing an issue with an Azure App Service hosted in the East US region where the application is no longer able to access the private key of an uploaded certificate.

The certificate is successfully located by thumbprint and appears in the Windows certificate store, however any attempt to access its RSA private key results in the following exception:

System.Security.Cryptography.CryptographicException
Keyset does not exist

Environment

• Service: Azure App Service (Windows)
• Region: East US
• Certificate: Uploaded PFX (private certificate)
• Certificate is loaded using WEBSITE_LOAD_CERTIFICATES
• Application: .NET

Observed Behavior

The application successfully locates the certificate by thumbprint from:

CurrentUser\My

However, retrieving the private key fails consistently:

var cert = GetCertificateByThumbprint(...);

var rsa = cert.GetRSAPrivateKey();

Result:

System.Security.Cryptography.CryptographicException
Keyset does not exist

The same behavior can be reproduced directly from the Kudu PowerShell console:

$cert = Get-Item "Cert:\CurrentUser\My\<thumbprint>"

which also throws:

Keyset does not exist

This demonstrates that the issue exists independently of our application code.

Troubleshooting Already Performed

We have already performed the following steps without success:

• Restarted the App Service multiple times.
• Removed and re-imported the certificate.
• Verified that the thumbprint is correct.
• Verified that WEBSITE_LOAD_CERTIFICATES is configured correctly.
• Confirmed that the certificate is present in CurrentUser\My.
• Confirmed that the failure can be reproduced directly from Kudu.

Since the problem is reproducible from Kudu, we do not believe this is an application issue.

Request

Is there a current problem with imported certificates and azure web-apps?

At this point, all evidence suggests the issue originates within the App Service certificate infrastructure rather than our application.

Any help is appreciated

Answer 1

Hi @Felix Aigner

Thank you for the very detailed write-up and for already performing thorough troubleshooting. Since the same “Keyset does not exist” error is reproducible directly from the Kudu PowerShell console, this confirms the issue is at the App Service platform level (the certificate object is present in CurrentUser\My, but the private-key container is not correctly attached to the worker).

Please try the following steps in order. These resolve the majority of this specific scenario:

1. Add / verify the critical app settings

Go to your App Service → Configuration → Application settings and ensure both of these are present:

WEBSITE_LOAD_CERTIFICATES = <your-certificate-thumbprint> (or * )

WEBSITE_LOAD_USER_PROFILE = 1

The second setting is frequently required for the private key to become accessible under the App Service identity. Save the changes.

2. Perform a full Stop → Wait → Start (not a Restart)

Click Stop on the App Service

Wait 4–5 minutes

Click Start

A simple Restart is often not sufficient to force a clean re-injection of the private-key container.

3. Verify the private key is now present

After the app has started, open the Kudu PowerShell console and run:

PowerShell

Get-ChildItem Cert:\CurrentUser\My | 

HasPrivateKey must return True. If it does, test your application code again (GetRSAPrivateKey()).

4. If HasPrivateKey is still False

Delete the certificate from TLS/SSL settings → Private Key Certificates

Export a fresh PFX from a machine where you can confirm “You have a private key that corresponds to this certificate”

Re-upload the new PFX

Update WEBSITE_LOAD_CERTIFICATES if the thumbprint changed

Repeat the full Stop → Wait → Start cycle and re-check HasPrivateKey

5. Isolation test (if the issue persists)

Create a brand-new App Service (or a new App Service Plan) in the same region, upload the same PFX, set the two app settings above, and test.

If it works on the new plan → the original plan has a corrupted worker state (scale out/in or move the app).

If it fails on the new plan as well → please open a support ticket and include the region (East US) + approximate timestamps of the failures so the platform team can investigate the certificate injection pipeline.

These steps address the exact failure mode you are seeing (certificate visible, private key container missing). Please try steps 1–3 first and reply with the result of the HasPrivateKey check — we can then decide the next action quickly.

Official Microsoft documentation

• https://learn.microsoft.com/en-us/azure/app-service/configure-ssl-certificate?tabs=apex%2Crbac%2Cazure-cli
• https://learn.microsoft.com/en-us/azure/app-service/configure-ssl-certificate-in-code?tabs=windows

If the answer is helpful, please do click "Accept the answer” and Yes, this can be beneficial to other community members.

Answer 2

Hi Felix,

If you haven't already, please verify that the private key exists for your certificate. You may do so in Kudu PowerShell console using command similar to below:

Get-ChildItem -Path Cert:\LocalMachine\My|Select Subject,Thumbprint,HasPrivateKey|fl

In the output, your certificate should have HasPrivateKey: True

Thanks.

-TP

Answer 3

hi Felix Aigner & thx for sharing urs issue here at Q&A portal,

The Kudu reproduction is strong evidence that this isn’t caused by your .NET code. App Service is loading the certificate entry into CurrentUser\My, but the worker can’t access the associated private-key container. WEBSITE_LOAD_CERTIFICATES is the supported mechanism for exposing uploaded private certificates to Windows App Service code. Finding the certificate successfully but getting Keyset does not exist from GetRSAPrivateKey() indicates an incomplete or broken certificate injection on that worker. Try stopping the app completely, waiting a few minutes, and starting it again rather than only restarting it. You can also scale to another App Service plan temporarily to force placement on different workers. If it works there, that further confirms a worker or regional platform issue.

If every new worker has the same result after deleting and re-uploading a valid password-protected PFX, this needs an App Service support case. Include the app name, plan, certificate thumbprint, exact UTC timestamps, affected instance IDs from WEBSITE_INSTANCE_ID, and the Kudu reproduction. Microsoft needs to inspect why the certificate metadata is present while its private key isn’t being mounted or made accessible.

rgds,

Alex

&

If my answer was helpful pls mark it and additional thx if u follow me at Q&A portal

and at my blog https://ctrlaltdel.blog/