In Windows cryptography systems, RSA key containers are stored in:

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys

The files follow this naming pattern:

[uniqueGUID]_[staticMachineGUID]

The staticGUID portion is indeed a machine identifier that remains constant across reboots. The uniqueGUID is derived from:

• The certificate's thumbprint (SHA-1 hash)
• The cryptographic service provider (CSP) being used
• The key container name specified during certificate generation

Here's a PowerShell script to find certificate-key file associations:

# Get all machine certificates
$certs = Get-ChildItem -Path Cert:\LocalMachine\My

foreach ($cert in $certs) {
    $containerName = $cert.PrivateKey.CspKeyContainerInfo.UniqueKeyContainerName
    $keyFile = Join-Path -Path $env:ProgramData -ChildPath "Microsoft\Crypto\RSA\MachineKeys\$containerName"
    
    if (Test-Path $keyFile) {
        Write-Output "Certificate $($cert.Thumbprint) uses key file: $keyFile"
    }
}

To modify permissions for a specific certificate's key file:

$cert = Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object { $_.Thumbprint -eq "YOUR_THUMBPRINT" }
$container = $cert.PrivateKey.CspKeyContainerInfo.UniqueKeyContainerName
$keyPath = "$env:ProgramData\Microsoft\Crypto\RSA\MachineKeys\$container"

# Grant read access to a service account
$acl = Get-Acl $keyPath
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule(
    "DOMAIN\ServiceAccount",
    "Read",
    "Allow"
)
$acl.AddAccessRule($rule)
Set-Acl -Path $keyPath -AclObject $acl

The uniqueGUID generation follows these rules:

1. For certificates created via certmgr: SHA-1 of (KeyContainerName + CSP Name)
2. For IIS auto-generated certificates: SHA-1 of (Thumbprint + Machine GUID)
3. For manually created keys: Random GUID with CSP-specific formatting

Permission problems: The NETWORK SERVICE or IIS_IUSRS account typically needs read access to the key file.

Missing key files: Run this command to rebuild the key-to-cert mapping:

certutil -repairstore my *

In Windows systems, cryptographic keys are stored in C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys. Each key container follows the naming pattern:

<uniqueGUID>_<staticGUID>

The <staticGUID> portion is indeed machine-specific, while the <uniqueGUID> is derived from:

• The certificate's thumbprint (SHA-1 hash)
• The cryptographic service provider (CSP) being used
• The key container name specified during certificate generation

Here's a PowerShell script to correlate key files with certificates:

# Get all machine certificates
$certs = Get-ChildItem -Path Cert:\LocalMachine\My

foreach ($cert in $certs) {
    # Calculate the expected key filename
    $thumbprint = $cert.Thumbprint.ToLower()
    $provider = $cert.PrivateKey.CspKeyContainerInfo.ProviderName
    $container = $cert.PrivateKey.CspKeyContainerInfo.KeyContainerName
    
    $keyName = "$($thumbprint)_$($container)"
    
    # Check if key file exists
    $keyPath = Join-Path -Path $env:ProgramData -ChildPath "Microsoft\Crypto\RSA\MachineKeys\$keyName"
    
    if (Test-Path $keyPath) {
        Write-Host "Certificate $($cert.Thumbprint) uses key file: $keyName"
    }
}

To set permissions on a specific key file:

$keyPath = "C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\<uniqueGUID>_<staticGUID>"
$acl = Get-Acl $keyPath
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule(
    "IIS_IUSRS",
    "Read",
    "Allow"
)
$acl.SetAccessRule($rule)
Set-Acl -Path $keyPath -AclObject $acl

Scenario 1: IIS application pool cannot access private key

Solution: Grant read permissions to the application pool identity using the script above.

Scenario 2: Certificate renewal creates new key container

Solution: The new certificate will generate a new <uniqueGUID> based on its thumbprint.

For applications needing direct cryptographic access:

// C# example using CryptoAPI
using System.Security.Cryptography;

var cspParams = new CspParameters {
    ProviderType = 1, // PROV_RSA_FULL
    KeyContainerName = "MyKeyContainer",
    Flags = CspProviderFlags.UseMachineKeyStore
};

using (var rsa = new RSACryptoServiceProvider(cspParams)) {
    // Cryptographic operations here
}