{"action":"created","issue":{"url":"https://api.github.com/repos/Azure/service-fabric-issues/issues/1053","repository_url":"https://api.github.com/repos/Azure/service-fabric-issues","labels_url":"https://api.github.com/repos/Azure/service-fabric-issues/issues/1053/labels{/name}","comments_url":"https://api.github.com/repos/Azure/service-fabric-issues/issues/1053/comments","events_url":"https://api.github.com/repos/Azure/service-fabric-issues/issues/1053/events","html_url":"https://github.com/Azure/service-fabric-issues/issues/1053","id":322277529,"node_id":"MDU6SXNzdWUzMjIyNzc1Mjk=","number":1053,"title":"CryptAcquireCertificatePrivateKey failed. Error:0x80090014","user":{"login":"AndriyGorda","id":39190675,"node_id":"MDQ6VXNlcjM5MTkwNjc1","avatar_url":"https://avatars2.githubusercontent.com/u/39190675?v=4","gravatar_id":"","url":"https://api.github.com/users/AndriyGorda","html_url":"https://github.com/AndriyGorda","followers_url":"https://api.github.com/users/AndriyGorda/followers","following_url":"https://api.github.com/users/AndriyGorda/following{/other_user}","gists_url":"https://api.github.com/users/AndriyGorda/gists{/gist_id}","starred_url":"https://api.github.com/users/AndriyGorda/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/AndriyGorda/subscriptions","organizations_url":"https://api.github.com/users/AndriyGorda/orgs","repos_url":"https://api.github.com/users/AndriyGorda/repos","events_url":"https://api.github.com/users/AndriyGorda/events{/privacy}","received_events_url":"https://api.github.com/users/AndriyGorda/received_events","type":"User","site_admin":false},"labels":[{"id":365329777,"node_id":"MDU6TGFiZWwzNjUzMjk3Nzc=","url":"https://api.github.com/repos/Azure/service-fabric-issues/labels/question","name":"question","color":"cc317c","default":true}],"state":"open","locked":false,"assignee":{"login":"vaishnavk","id":11414395,"node_id":"MDQ6VXNlcjExNDE0Mzk1","avatar_url":"https://avatars1.githubusercontent.com/u/11414395?v=4","gravatar_id":"","url":"https://api.github.com/users/vaishnavk","html_url":"https://github.com/vaishnavk","followers_url":"https://api.github.com/users/vaishnavk/followers","following_url":"https://api.github.com/users/vaishnavk/following{/other_user}","gists_url":"https://api.github.com/users/vaishnavk/gists{/gist_id}","starred_url":"https://api.github.com/users/vaishnavk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vaishnavk/subscriptions","organizations_url":"https://api.github.com/users/vaishnavk/orgs","repos_url":"https://api.github.com/users/vaishnavk/repos","events_url":"https://api.github.com/users/vaishnavk/events{/privacy}","received_events_url":"https://api.github.com/users/vaishnavk/received_events","type":"User","site_admin":false},"assignees":[{"login":"vaishnavk","id":11414395,"node_id":"MDQ6VXNlcjExNDE0Mzk1","avatar_url":"https://avatars1.githubusercontent.com/u/11414395?v=4","gravatar_id":"","url":"https://api.github.com/users/vaishnavk","html_url":"https://github.com/vaishnavk","followers_url":"https://api.github.com/users/vaishnavk/followers","following_url":"https://api.github.com/users/vaishnavk/following{/other_user}","gists_url":"https://api.github.com/users/vaishnavk/gists{/gist_id}","starred_url":"https://api.github.com/users/vaishnavk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vaishnavk/subscriptions","organizations_url":"https://api.github.com/users/vaishnavk/orgs","repos_url":"https://api.github.com/users/vaishnavk/repos","events_url":"https://api.github.com/users/vaishnavk/events{/privacy}","received_events_url":"https://api.github.com/users/vaishnavk/received_events","type":"User","site_admin":false},{"login":"dragav","id":19940839,"node_id":"MDQ6VXNlcjE5OTQwODM5","avatar_url":"https://avatars0.githubusercontent.com/u/19940839?v=4","gravatar_id":"","url":"https://api.github.com/users/dragav","html_url":"https://github.com/dragav","followers_url":"https://api.github.com/users/dragav/followers","following_url":"https://api.github.com/users/dragav/following{/other_user}","gists_url":"https://api.github.com/users/dragav/gists{/gist_id}","starred_url":"https://api.github.com/users/dragav/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dragav/subscriptions","organizations_url":"https://api.github.com/users/dragav/orgs","repos_url":"https://api.github.com/users/dragav/repos","events_url":"https://api.github.com/users/dragav/events{/privacy}","received_events_url":"https://api.github.com/users/dragav/received_events","type":"User","site_admin":false}],"milestone":null,"comments":6,"created_at":"2018-05-11T12:23:27Z","updated_at":"2018-10-02T08:28:06Z","closed_at":null,"author_association":"NONE","body":"Hello team,\r\n\r\nCould you please provide a fix or suggest a workaround? We are blocked for 2 days already.\r\n\r\nSince May 10 our Azure clusters are down with nodes been unable to read private key from certificate.\r\nSince January 2018 they were working without issues.\r\nThe certificate is the same as before, was not changed and currently present on the nodes, with private key in it. \r\nRecreation of cluster from the scratch leads to the same error.\r\nAlso recreation of cluster with previous Service Fabric version in ARM template leads to the same error as well.\r\n\r\nNode event log has such errors and warnings as:\r\n\r\n- Can't get private key filename for certificate. Error: 0x80090014\r\n- CryptAcquireCertificatePrivateKey failed. Error:0x80090014\r\n- Can't ACL FileStoreService/SecondaryAccountNTLMX509Thumbprint, ErrorCode E_FAIL\r\n- SetCertificateAcls failed. ErrorCode: E_FAIL\r\n- Failed to get private key file. x509FindValue: 406193559C7123964B309347720A3D3D5CD6EF2A, x509StoreName: My, findType: FindByThumbprint, Error E_FAIL\r\n\r\nThis seems to relate to https://github.com/Azure/service-fabric-issues/issues/235.\r\n\r\nThank you in advance,\r\nAndriy\r\n"},"comment":{"url":"https://api.github.com/repos/Azure/service-fabric-issues/issues/comments/426191634","html_url":"https://github.com/Azure/service-fabric-issues/issues/1053#issuecomment-426191634","issue_url":"https://api.github.com/repos/Azure/service-fabric-issues/issues/1053","id":426191634,"node_id":"MDEyOklzc3VlQ29tbWVudDQyNjE5MTYzNA==","user":{"login":"Adebeer","id":234856,"node_id":"MDQ6VXNlcjIzNDg1Ng==","avatar_url":"https://avatars1.githubusercontent.com/u/234856?v=4","gravatar_id":"","url":"https://api.github.com/users/Adebeer","html_url":"https://github.com/Adebeer","followers_url":"https://api.github.com/users/Adebeer/followers","following_url":"https://api.github.com/users/Adebeer/following{/other_user}","gists_url":"https://api.github.com/users/Adebeer/gists{/gist_id}","starred_url":"https://api.github.com/users/Adebeer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Adebeer/subscriptions","organizations_url":"https://api.github.com/users/Adebeer/orgs","repos_url":"https://api.github.com/users/Adebeer/repos","events_url":"https://api.github.com/users/Adebeer/events{/privacy}","received_events_url":"https://api.github.com/users/Adebeer/received_events","type":"User","site_admin":false},"created_at":"2018-10-02T08:28:06Z","updated_at":"2018-10-02T08:28:06Z","author_association":"NONE","body":"I'm having the same issue - it's driving me nuts. I can create the cluster just fine using self signed certificates using [CertSetup.ps1](https://docs.microsoft.com/en-us/azure/service-fabric/service-fabric-windows-cluster-x509-security#optional-create-a-self-signed-certificate).\r\n\r\nHowever I have yet to get it working using CA/Root signing my own server/cluster signed certificates generated via New-SelfSignedCertificate. My signed certificates all look fine and are fully trusted via my CA certificates. Both cluster/server certificates have Server Authentication (1.3.6.1.5.5.7.3.1)  with key usage Digital Signature, Key Enchiperhement. They also have NETWORK Service already set for private key.\r\n\r\nThanks @dragav : I did try your suggestion but it still didn't work. That said, looking at CertSetup file, it uses provider \"Microsoft RSA SChannel Cryptographic Provider\" - so I'll give this one a go next.\r\n"}}
{"actor":{"display_login":"Adebeer"}}