title: Certificate recreation after upgrading to .NET Framework 4.8
body: <p>I've upgraded one of our web applications from .NET Framework 4.6 to 4.8. Somewhere deep inside the code an XML string gets signed and this signed XML is sent back to the client which will verify the signature. The XML signing uses the <a href="https://docs.microsoft.com/en-us/dotnet/api/system.security.cryptography.xml.signedxml?view=netframework-4.8" rel="nofollow noreferrer"><code>SignedXml</code></a> class.</p>
  <p>Due to its legacy nature, SHA1 is still used (bear with me!). To not break this behavior when upgrading the .NET Framework, I had to set the following AppContext switches before actually signing the XML:</p>
  <pre class="lang-cs prettyprint-override"><code>AppContext.SetSwitch(&quot;Switch.System.Security.Cryptography.Xml.UseInsecureHashAlgorithms&quot;, true);
  AppContext.SetSwitch(&quot;Switch.System.Security.Cryptography.Pkcs.UseInsecureHashAlgorithms&quot;, true);
  </code></pre>
  <p>That solved all issues on my local machine and I could successfully sign the XMLs.</p>
  <p>Now when moving forward and deploying the new code version onto our staging environment, a new problem came up: the XML signing fails with an <code>Invalid algorithm specified</code> exception. Here is the stack trace:</p>
  <pre><code>at System.Security.Cryptography.CryptographicException.ThrowCryptographicException(Int32 hr)
  at System.Security.Cryptography.Utils.SignValue(SafeKeyHandle hKey, Int32 keyNumber, Int32 calgKey, Int32 calgHash, Byte[] hash, Int32 cbHash, ObjectHandleOnStack retSignature)
  at System.Security.Cryptography.Utils.SignValue(SafeKeyHandle hKey, Int32 keyNumber, Int32 calgKey, Int32 calgHash, Byte[] hash)
  at System.Security.Cryptography.RSACryptoServiceProvider.SignHash(Byte[] rgbHash, Int32 calgHash)
  at System.Security.Cryptography.Xml.SignedXml.ComputeSignature()
  </code></pre>
  <p>Now I stumbled across <a href="https://stackoverflow.com/questions/7433074/why-am-i-getting-invalid-algorithm-specified-exception">this question</a> and especially <a href="https://stackoverflow.com/a/60702121/4919526">that particular answer</a>.<br />
  So I checked the CSPs using <code>certutil</code> and I'm getting the following results:</p>
  <ul>
  <li>Local → <code>Microsoft Enhanced RSA and AES Cryptographic Provider</code> → works</li>
  <li>Staging → <code>Microsoft Enhanced Cryptographic Provider v1.0</code> → doesn't work</li>
  </ul>
  <p><strong>Question</strong>: is there any chance to mitigate this behavior, e. g. by using another piece of code to sign the XML? Or do I have to recreate the certificate?</p>
  <p>Thanks in advance!</p>