title: MSBuild cannot sign a ClickOnce manifest using a temporary key (errors MSB3326 and MSB3321)
body: <p>I am trying to build a ClickOnce <a href="http://en.wikipedia.org/wiki/Windows_Forms" rel="nofollow noreferrer">Windows Forms</a> project (.NET 3.5 / Visual Studio 2010) on a Windows Server computer. <em>(In an effort to automate the build process with <a href="http://en.wikipedia.org/wiki/Hudson_%28software%29" rel="nofollow noreferrer">Hudson</a> <a href="http://en.wikipedia.org/wiki/Continuous_integration" rel="nofollow noreferrer">CI</a>.)</em></p>
  
  <p>For signing the ClickOnce manifest I created a temporary key in Visual Studio, <code>temp.pfx</code>. I can successfully build and deploy the project from Visual Studio on my workstation. But when running <a href="http://en.wikipedia.org/wiki/MSBuild" rel="nofollow noreferrer">MSBuild</a> on the server I get the following error messages:</p>
  
  <blockquote>
    <p>C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Common.targets(1970,9): error MSB3326: Cannot import the following key file: . The key file may be password protected. To correct this, try to import the certificate again or import the certificate manually into the current user's personal certificate store. [C:.hudson\jobs[...].csproj]</p>
    
    <p>C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Common.targets(1970,9): error MSB3321: Importing key file "temp.pfx" was canceled. [C:.hudson\jobs[...].csproj]</p>
  </blockquote>
  
  <p>I tried all of the following questions and answers without luck:</p>
  
  <ul>
  <li><p>Stack Overflow question <em><a href="https://stackoverflow.com/questions/2815366">Cannot import the keyfile 'blah.pfx' - error 'The keyfile may be password protected'</a></em></p>
  
  <p>=> In my case, the error message does not indicate a name of a certificate store but says "the current user's personal certificate store" instead.</p>
  
  <p>=> Even when trying the accepted answer with "Personal" as the container name (<code>sn -i temp.pfx personal</code>), it fails to parse the key:</p>
  
  <blockquote>
    <p>Failed to parse the PKCS#12 blob in ALiS_TemporaryKey.pfx -- An internal error o
    ccurred.</p>
  </blockquote></li>
  <li><p>Stack Overflow question <em><a href="https://stackoverflow.com/questions/885484">Using MSBuild to sign ClickOnce or assembly results in error MSB3321</a></em></p>
  
  <p>=> I tried the accepted answer, but the key file cannot be imported because <em>"Either the user profile is not accessible or the private key that you are importing might require a cryptographic service provider that is not installed on your system"</em></p>
  
  <p>=> The same happens if I try to import the file by double-clicking it in Windows Explorer (RobinDotNet's suggestion)</p></li>
  <li><p>Stack Overflow question <em><a href="https://stackoverflow.com/questions/4025316">Signing assemblies with PFX files in MSBuild, Team Build, and TFS</a></em></p>
  
  <p>=> The OP of that question was unsuccessful with the above two answers, too, but unfortunately not even the answers that he got would help me:</p>
  
  <blockquote>
    <p>Log in as the user that runs MSBuild on the build machine, manually invoke MSBuild, and then type in the password when prompted.</p>
  </blockquote>
  
  <p>=> I logged in and ran <code>msbuild myproject.sln</code> but it would not even prompt me for the password.</p>
  
  <blockquote>
    <p>What finally fixed it for me was making the account under which TFS Build service runs an administrator on the local machine.</p>
  </blockquote>
  
  <p>=> The account that runs Hudson (more precisely: <a href="http://en.wikipedia.org/wiki/Apache_Tomcat" rel="nofollow noreferrer">Tomcat</a>) already <em>is</em> a local administrator. I tried to run MSBuild from a "Run As Administrator" command line even and would get the same error messages still.</p></li>
  </ul>
  
  <hr>
  
  <p><strong>Update:</strong> I tried to open the solution in Visual Studio on the same server and build it. I get the same error. When I try to re-import the PFX file in the project properties' Signing tab, it tells me "invalid password". If I try to import the very same file in the very same solution in Visual Studio on my workstation and provide the very same password, it is accepted.</p>
  
  <p><strong>Update 2:</strong> If I take an old temporary key which I had generated with Visual&nbsp;Studio&nbsp;2008, it can be successfully imported in the certificate store of our server; any temporary keys I newly create with Visual Studio 2010 cannot be imported.</p>
  
  <p><strong>Update 3:</strong> I was able to create a new "temporary key" in Visual Studio on the server and use it both on the server as well as on my workstation for signing the ClickOnce manifest. I only cannot make up a reasonable explanation for it - both computers are 64-bit, and I am using Visual Studio 2010 on both. Both have the v3.5 and v4 (4.0.30319) .NET framework installed. My workstation is a Windows 7 Professional, and the server is a <a href="http://en.wikipedia.org/wiki/Windows_Server_2008" rel="nofollow noreferrer">Windows Server 2008</a> R2 Standard.</p>