visual-studio 无法导入密钥文件“blah.pfx” - 错误“密钥文件可能受密码保护”

Cannot import the keyfile 'blah.pfx' - error 'The keyfile may be password protected'

提问by JasonD

We just upgraded our Visual Studio 2008 projects to Visual Studio 2010. All of our assemblies were strong signed using a Verisigncode signing certificate. Since the upgrade we continuously get the following error:

我们刚刚将 Visual Studio 2008 项目升级到 Visual Studio 2010。我们所有的程序集都使用Verisign代码签名证书进行了强签名。自升级以来，我们不断收到以下错误：

Cannot import the following key file: companyname.pfx. The key file may be password protected. To correct this, try to import the certificate again or manually install the certificate to the Strong Name CSP with the following key container name: VS_KEY_3E185446540E7F7A

无法导入以下密钥文件：companyname.pfx。密钥文件可能受密码保护。要更正此问题，请尝试再次导入证书或使用以下密钥容器名称手动将证书安装到强名称 CSP：VS_KEY_3E185446540E7F7A

This happens on some developer machines and not others. Some methods used to fix this that worked some of the time include:

这发生在某些开发人员机器上，而不是其他机器上。用于解决此问题的一些方法有时会奏效，包括：

• Re-installing the key file from Windows Explorer (right click on the PFX file and click Install)
• Installing Visual Studio 2010 on a fresh machine for the first time prompts you for the password the first time you open the project, and then it works. On machines upgraded from Visual Studio 2008, you don't get this option.

• 从 Windows 资源管理器重新安装密钥文件（右键单击 PFX 文件并单击安装）
• 第一次在新机器上安装Visual Studio 2010，第一次打开项目时提示输入密码，然后就可以了。在从 Visual Studio 2008 升级的计算机上，您没有此选项。

I've tried using the SN.EXEutility (Strong Name Tool) to register the key with the Strong Name CSP as the error message suggests, but whenever I run the tool with any options using the version that came with Visual Studio 2010, SN.EXE just lists its command line arguments instead of doing anything. This happens regardless of what arguments I supply.

我已经尝试使用SN.EXE实用程序（强名称工具）向强名称 CSP 注册密钥，如错误消息所示，但是每当我使用 Visual Studio 2010 随附的版本运行带有任何选项的工具时，SN .EXE 只是列出它的命令行参数而不是做任何事情。无论我提供什么论据，都会发生这种情况。

Why is this happening, and what are clear steps to fix it? I'm about to give up on ClickOnceinstalls and Microsoft code signing.

为什么会发生这种情况，以及修复它的明确步骤是什么？我即将放弃ClickOnce安装和 Microsoft 代码签名。

回答by Brandon Manchester

I was running into this problem as well. I was able to resolve the issue by running
sn -i <KeyFile> <ContainerName>(installs key pair into a named container).

我也遇到了这个问题。我能够通过运行
sn -i <KeyFile> <ContainerName>（将密钥对安装到命名容器中）来解决该问题。

snis usually installed as part of a Windows SDK. For example C:\Program Files (x86)\Microsoft SDKs\Windows\v8.0A\bin\NETFX 4.0 Tools\sn.exe. Most likely this location is not on the search path for your standard environment. However, the "Developer Command Prompt" installed by Visual Studio adds additional information that usually includes the correct location.

sn通常作为 Windows SDK 的一部分安装。例如C:\Program Files (x86)\Microsoft SDKs\Windows\v8.0A\bin\NETFX 4.0 Tools\sn.exe。此位置很可能不在您的标准环境的搜索路径上。但是，Visual Studio 安装的“开发人员命令提示符”添加了通常包含正确位置的附加信息。

Based on your post that would look like

根据您的帖子，看起来像

sn -i companyname.pfx VS_KEY_3E185446540E7F7A

sn -i companyname.pfx VS_KEY_3E185446540E7F7A

This must be run from the location of your PFX file, if you have the solution loaded in VS 2010 you can simply right click on the pfx file from the solution explorer and choose Open Command Prompt which will launch the .net 2010 cmd prompt tool in the correct directory.

这必须从您的 PFX 文件的位置运行，如果您在 VS 2010 中加载了解决方案，您只需右键单击解决方案资源管理器中的 pfx 文件，然后选择打开命令提示符，它将启动 .net 2010 cmd 提示符工具正确的目录。

Before running this sn command I did re-install the pfx by right clicking on it and choosing install however that did not work. Just something to note as it might be the combination of both that provided the solution.

在运行此 sn 命令之前，我确实通过右键单击它并选择安装来重新安装 pfx，但是这不起作用。只是需要注意一些事情，因为它可能是提供解决方案的两者的结合。

Hope this helps solve your problem.

希望这有助于解决您的问题。

回答by MagicBox

I've discovered a fix that helps you be able to build successfully in a multi developer environment:

我发现了一个修复程序，可以帮助您在多开发人员环境中成功构建：

Instead of changing the password (which causes the .pfx to be changed), reselectthe .pfx file from the combobox. This then invokes the password dialog. After entering the password, the project will build OK. Every dev can do this on his local machine without actually modifying the .pfx file.

不要更改密码（这会导致 .pfx 被更改），而是从组合框中重新选择.pfx 文件。然后调用密码对话框。输入密码后，项目就build OK了。每个开发人员都可以在他的本地机器上执行此操作，而无需实际修改 .pfx 文件。

I'm still having problems getting assemblies to be signed on our build server machine. I'm getting the same error there, however using the sn.exe -i method does not fix the problem for the buildserver.

我仍然无法在我们的构建服务器机器上对程序集进行签名。我在那里遇到了同样的错误，但是使用 sn.exe -i 方法并不能解决 buildserver 的问题。

回答by Beached

I had the same issue and deleting the store and reading didn't work. I had to do the following.

我遇到了同样的问题，删除商店和阅读不起作用。我必须执行以下操作。

• Get a copy of OpenSSL. It is available for Windows. Or use a Linux box as they all pretty much all have it.

• Run the following to export to a key file:

  openssl pkcs12 -in certfile.pfx -out backupcertfile.key
  
  openssl pkcs12 -export -out certfiletosignwith.pfx -keysig -in backupcertfile.key
  

• 获取一份OpenSSL。它适用于 Windows。或者使用 Linux 机器，因为他们几乎都有。

• 运行以下命令以导出到密钥文件：

  openssl pkcs12 -in certfile.pfx -out backupcertfile.key
  
  openssl pkcs12 -export -out certfiletosignwith.pfx -keysig -in backupcertfile.key
  

Then in the project properties you can use the PFX file.

然后在项目属性中您可以使用 PFX 文件。

回答by Mike F

I spoke too soon! Rebuild brought the errors back into play...

我说话太快了！重建使错误重新发挥作用......

I found this works - right click in Solution Explorerand exclude it from the project. Click Show all files, right click and now include it in the project again. Now undo pending changes...

我发现这有效 - 在解决方案资源管理器中右键单击并将其从项目中排除。单击Show all files，右键单击，现在再次将其包含在项目中。现在撤消挂起的更改...

For some reason this sorted it out for me and was relatively painless!

出于某种原因，这为我整理了它并且相对轻松！

回答by Dariusz

I found that in some cases you should try to deletethis key beforeyou install it. So do the following:

我发现在某些情况下，您应该在安装之前尝试删除此密钥。因此，请执行以下操作：

1. sn -d VS_XXXX
2. sn -i mykey.pfx VS_XXX

1. sn -d VS_XXXX
2. sn -i mykey.pfx VS_XXX

回答by Jarek Kardas

VSCommands 2010 (plugin for Visual Studio) can fix this for you automatically - just right-click on error and click Apply Fix from the menu. You can get it from Visual Studio gallery.

VSCommands 2010（Visual Studio 插件）可以自动为您修复此问题 - 只需右键单击错误并从菜单中单击应用修复。您可以从 Visual Studio 库中获取它。

回答by atlaste

After trying all these solutions (and a lot more), I found that the problem lies somewhere else. For people that go through the same misery as me after buying a certificate, I'll share the solution for my problem.

在尝试了所有这些解决方案（以及更多）之后，我发现问题出在其他地方。对于购买证书后和我一样痛苦的人，我将分享我的问题的解决方案。

Behavior

行为

I understand that 'sign' applies a strong name and not an authenticode to a DLL or EXE. This is why signtool willwork in this case, but 'sign' in Visual studio will not work.

我知道“符号”对 DLL 或 EXE 应用强名称而不是验证码。这就是为什么 signtool在这种情况下可以工作，但 Visual Studio 中的“签名”不起作用。

Reason

原因

In the past I've had experience with certificates from Verisign. They have a KeySpec=2in the certificate - which is used with the 'sign' functionality in Visual Studio. These certificates work fine for both Visual Studio and signtool.

过去，我有使用 Verisign 证书的经验。它们KeySpec=2在证书中有一个- 与 Visual Studio 中的“签名”功能一起使用。这些证书适用于 Visual Studio 和 signtool。

I now bought certificates from Comodo, which have an incorrect KeySpec=1in the code signing certificates. That means these certificates work fine with signtool (authenticode) but not with strong naming (the sign drop-down).

我现在从 Comodo 购买了证书，该KeySpec=1证书的代码签名证书有误。这意味着这些证书适用于 signtool（验证码），但不适用于强命名（sign 下拉菜单）。

Solution

解决方案

There are two ways to solve this issue:

有两种方法可以解决这个问题：

1. Create a separate certificate for your strong name using sn -k [name].snk. Sign the assembly using the snk and afterwards use signtool with your code signing certificate to do sign the DLL/EXE with the authenticode signature. While this seems strange, from what I understand this is a correct way to deal with certificates, because strong names have a different purpose than authenticode (see also this linkfor details on how this works).
2. Import your certificate as KeySpec=2. The procedure for this is detailed here.

1. 使用 为您的强名称创建单独的证书sn -k [name].snk。使用 snk 对程序集进行签名，然后使用带有代码签名证书的 signtool 使用验证码签名对 DLL/EXE 进行签名。虽然这看起来很奇怪，但据我所知，这是处理证书的正确方法，因为强名称与身份验证码的用途不同（另请参阅此链接以了解其工作原理）。
2. 将您的证书导入为KeySpec=2. 这样做的过程赘述。

Because I want to use multiple strong names, I currently use option (1), although option (2) also works.

因为我想使用多个强名称，所以我目前使用选项 (1)，尽管选项 (2) 也有效。

---

---

To ensure this solution will never get lost in the future, here's the procedure of solution 2:

为确保此解决方案将来不会丢失，这里是解决方案2的过程：

1. Using the "Certifiates" MMC export the existing keyset (KeySpec=1) to a PFX file. Note: Please backup this file to a safe location and test if the file can be imported ok on another machine if you really want to play it safe!
2. Delete the existing certificate from the crypto store (stlll using the MMC).
3. Open a CMD prompt.
4. Import the PFX file using this command:
   1. certutil -importPFX -user <pfxfilename> AT_SIGNATURE
   2. Enter the passphrase for the pfx when prompted.

1. 使用“证书”MMC 将现有密钥集 ( KeySpec=1)导出到 PFX 文件。注意：请将此文件备份到安全位置并测试该文件是否可以在另一台机器上正常导入，如果您真的想安全播放！
2. 从加密存储中删除现有证书（仍然使用 MMC）。
3. 打开 CMD 提示。
4. 使用以下命令导入 PFX 文件：
   1. certutil -importPFX -user <pfxfilename> AT_SIGNATURE
   2. 出现提示时输入 pfx 的密码。

You now should have a keyset/certificate with KeySpec=2. If needed you can now export this into another PFX file using the MMC again.

您现在应该有一个带有KeySpec=2. 如果需要，您现在可以再次使用 MMC 将其导出到另一个 PFX 文件中。

回答by Romeo

To resolve this problem in Visual Studio 2012, I right click the project, properties -> "signing", and then uncheck the "Sign the ClickOnce manifests".

要在 Visual Studio 2012 中解决此问题，我右键单击项目，属性 ->“签名”，然后取消选中“签署 ClickOnce 清单”。

回答by Bala Kumar

I reselected the Key(pfx) file in the "Choose a Strong Name Key File" drop-down box, Then provided password in the "ENTER PASSWORD" Popup Window. Saved my project and did rebuild.build succeeded.

我在“选择强名称密钥文件”下拉框中重新选择了密钥（pfx）文件，然后在“输入密码”弹出窗口中提供了密码。保存了我的项目并且rebuild.build 成功了。

• Open Project Properties.
• Click on the Signing section.
• Where it says ‘Choose a strong name key file:', reselect the current value from the drop-down box:

• 打开项目属性。
• 单击签名部分。
• 在显示“选择强名称密钥文件：”的地方，从下拉框中重新选择当前值：

• Visual Studio will now prompt you for the password. Enter it.

• Visual Studio 现在将提示您输入密码。输入它。

• Save your project and do a rebuild.

• If get error message:”An attempt was made to reference a token that does not exist” just ignore it and Continue the below steps

• Click the ‘Change Password” button:

• 保存您的项目并进行重建。

• 如果收到错误消息：“尝试引用不存在的令牌”只需忽略它并继续以下步骤

• 单击“更改密码”按钮：

• Enter the original password in all three boxes and click OK. If you'd like to change your password (or if your old password doesn't meet complexity requirements), you can do so now.

• Save your project and do a rebuild.

• 在所有三个框中输入原始密码，然后单击“确定”。如果您想更改密码（或者如果您的旧密码不符合复杂性要求），您现在可以这样做。

• 保存您的项目并进行重建。

More Info..

更多信息..

回答by user350076

As a workaround, I tried running the Visual Studio 2010 as an administrator, and it worked for me.

作为一种解决方法，我尝试以管理员身份运行 Visual Studio 2010，它对我有用。

I hope this helps.

我希望这有帮助。