Deploy to IIS - Certificate access denied error

[sravanth.pl]

Hi,

I am facing the below error while deploying the web application to IIS website through Octopus. It was working perfectly till yesterday, but suddenly I am facing below error. I have tried all the ways but could not get any fix. Please help me.

Deploying package: D:\Octopus\Files\MyProject.Configuration.Web@S1.0.0-rev.216@7F720DCD06A9A6429C30CF0493453ADD.zip
January 22nd 2020 10:47:24Info
No matching appSetting, applicationSetting, nor connectionString names were found in: D:\Octopus\Applications\myinstance_MyProject\MyProject-Dev-CI\MyProject.Configuration.Web\1.0.0-rev.216_2\web.config
January 22nd 2020 10:47:24Info
Performing JSON variable replacement on ‘D:\Octopus\Applications\myinstance_MyProject\MyProject-Dev-CI\MyProject.Configuration.Web\1.0.0-rev.216_2\assets\app.config.json’
January 22nd 2020 10:47:28Info
Making sure a Website “myinstance_MyProjectMyProjectConfigurationWeb” is configured in IIS…
January 22nd 2020 10:47:29Info
Finding SSL certificate with thumbprint MYSSLthumbprint
January 22nd 2020 10:47:29Info
Found certificate: cert details in: My
January 22nd 2020 10:47:31Info
The required certificate binding is already in place
January 22nd 2020 10:47:32Info
Application pool “myinstance_MyProjectMyProjectConfigurationWebPool” already exists
January 22nd 2020 10:47:32Info
Set application pool identity: SpecificUser
January 22nd 2020 10:47:34Info
Set .NET framework version: No Managed Code
January 22nd 2020 10:47:34Info
Site “myinstance_MyProjectMyProjectConfigurationWeb” already exists
January 22nd 2020 10:47:34Info
Application pool “myinstance_MyProjectMyProjectConfigurationWebPool” already assigned to “IIS:\Sites\myinstance_MyProjectMyProjectConfigurationWeb”
January 22nd 2020 10:47:35Info
Setting physical path of IIS:\Sites\myinstance_MyProjectMyProjectConfigurationWeb to D:\Octopus\Applications\myinstance_MyProject\MyProject-Dev-CI\MyProject.Configuration.Web\1.0.0-rev.216_2
January 22nd 2020 10:47:35Info
Comparing existing IIS bindings with configured bindings…
January 22nd 2020 10:47:36Info
Looks OK
January 22nd 2020 10:47:36Info
Bindings are as configured. No changes required.
January 22nd 2020 10:47:36Info
Anonymous authentication enabled: True
January 22nd 2020 10:47:37Info
Applied configuration changes to section “system.webServer/security/authentication/anonymousAuthentication” for “MACHINE/WEBROOT/APPHOST/myinstance_MyProjectMyProjectConfigurationWeb” at configuration commit path “MACHINE/WEBROOT/APPHOST”
January 22nd 2020 10:47:37Info
Basic authentication enabled: False
January 22nd 2020 10:47:37Info
Applied configuration changes to section “system.webServer/security/authentication/basicAuthentication” for “MACHINE/WEBROOT/APPHOST/myinstance_MyProjectMyProjectConfigurationWeb” at configuration commit path “MACHINE/WEBROOT/APPHOST”
January 22nd 2020 10:47:38Info
Windows authentication enabled: False
January 22nd 2020 10:47:38Info
Applied configuration changes to section “system.webServer/security/authentication/windowsAuthentication” for “MACHINE/WEBROOT/APPHOST/myinstance_MyProjectMyProjectConfigurationWeb” at configuration commit path “MACHINE/WEBROOT/APPHOST”
January 22nd 2020 10:47:40Info
Web site is stopped. Attempting to start…
January 22nd 2020 10:47:40Info
IIS configuration complete
January 22nd 2020 10:47:40Error
System.Exception: Could not set security on private-key —> System.Security.Cryptography.CryptographicException: Access is denied.
January 22nd 2020 10:47:40Error
at Calamari.Integration.Certificates.WindowsX509CertificateStore.SetCspPrivateKeySecurity(SafeCertContextHandle certificate, ICollection1 accessRules) January 22nd 2020 10:47:40Error at Calamari.Integration.Certificates.WindowsX509CertificateStore.AddPrivateKeyAccessRules(ICollection1 accessRules, SafeCertContextHandle certificate)
January 22nd 2020 10:47:40Error
— End of inner exception stack trace —
January 22nd 2020 10:47:40Error
at Calamari.Integration.Certificates.WindowsX509CertificateStore.AddPrivateKeyAccessRules(ICollection1 accessRules, SafeCertContextHandle certificate) January 22nd 2020 10:47:40Error at Calamari.Integration.Certificates.WindowsX509CertificateStore.AddPrivateKeyAccessRules(String thumbprint, StoreLocation storeLocation, String storeName, ICollection1 privateKeyAccessRules)
January 22nd 2020 10:47:40Error
at Calamari.Deployment.Features.IisWebSiteAfterPostDeployFeature.EnsureApplicationPoolHasCertificatePrivateKeyAccess(VariableDictionary variables)
January 22nd 2020 10:47:40Error
at Calamari.Deployment.Features.IisWebSiteAfterPostDeployFeature.Execute(RunningDeployment deployment)
January 22nd 2020 10:47:40Error
at Calamari.Deployment.Conventions.FeatureConventionBase.ExecuteFeatureClasses(RunningDeployment deployment, String feature)
January 22nd 2020 10:47:40Error
at Calamari.Deployment.Conventions.FeatureConventionBase.Run(RunningDeployment deployment)
January 22nd 2020 10:47:40Error
at Calamari.Deployment.ConventionProcessor.RunInstallConventions()
January 22nd 2020 10:47:40Error
at Calamari.Deployment.ConventionProcessor.RunConventions()
January 22nd 2020 10:47:40Error
Running rollback conventions…
January 22nd 2020 10:47:42Error
Could not set security on private-key
January 22nd 2020 10:47:42Error
System.Exception
January 22nd 2020 10:47:42Error
at Calamari.Integration.Certificates.WindowsX509CertificateStore.AddPrivateKeyAccessRules(ICollection1 accessRules, SafeCertContextHandle certificate) January 22nd 2020 10:47:42Error at Calamari.Integration.Certificates.WindowsX509CertificateStore.AddPrivateKeyAccessRules(String thumbprint, StoreLocation storeLocation, String storeName, ICollection1 privateKeyAccessRules)
January 22nd 2020 10:47:42Error
at Calamari.Deployment.Features.IisWebSiteAfterPostDeployFeature.EnsureApplicationPoolHasCertificatePrivateKeyAccess(VariableDictionary variables)
January 22nd 2020 10:47:42Error
at Calamari.Deployment.Features.IisWebSiteAfterPostDeployFeature.Execute(RunningDeployment deployment)
January 22nd 2020 10:47:42Error
at Calamari.Deployment.Conventions.FeatureConventionBase.ExecuteFeatureClasses(RunningDeployment deployment, String feature)
January 22nd 2020 10:47:42Error
at Calamari.Deployment.Conventions.FeatureConventionBase.Run(RunningDeployment deployment)
January 22nd 2020 10:47:42Error
at Calamari.Deployment.ConventionProcessor.RunInstallConventions()
January 22nd 2020 10:47:42Error
at Calamari.Deployment.ConventionProcessor.RunConventions()
January 22nd 2020 10:47:42Error
at Calamari.Commands.DeployPackageCommand.Execute(String[] commandLineArguments)
January 22nd 2020 10:47:42Error
at Calamari.Program.Execute(String[] args)
January 22nd 2020 10:47:42Error
–Inner Exception–
January 22nd 2020 10:47:42Error
Access is denied.
January 22nd 2020 10:47:42Error
System.Security.Cryptography.CryptographicException
January 22nd 2020 10:47:42Error
at Calamari.Integration.Certificates.WindowsX509CertificateStore.SetCspPrivateKeySecurity(SafeCertContextHandle certificate, ICollection1 accessRules) January 22nd 2020 10:47:42Error at Calamari.Integration.Certificates.WindowsX509CertificateStore.AddPrivateKeyAccessRules(ICollection1 accessRules, SafeCertContextHandle certificate)
January 22nd 2020 10:47:42Fatal
The remote script failed with exit code 100
January 22nd 2020 10:47:42Fatal
The action Deploy to IIS on MyProject-DEVWEB-MYSERVER failed

[paul.calvert]

Hi @sravanth.pl,

Thanks for getting in touch!

We’ve seen a number of users encountering this issue suddenly, one of the users has identified that McAfee is blocking access to machinekeys.
Are you also using McAfee?
If not, could you check the logs for your AV to see if it is also blocking access?

Regards,
Paul

[sravanth.pl]

HI Paul,

Thanks for your prompt response.
You are correct, we also found the root cause of the issue after troubleshooting a day, this is due to Mcafee is blocking the C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys folder.

We have excluded this folder from Mcafee checks and now deployments are working as usual.

FYI, we found this error in event viewer logs.

NT AUTHORITY\SYSTEM ran D:\Octopus\Calamari\7.1.9\Calamari.exe, which tried to access C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys violating the rule “Malware Behavior : Windows EFS abuse”, and was blocked. For information about how to respond to this event, see KB85494.

Hope this helps someone.