title: Data protection in ASP.NET Core 2.1 only works on one machine
body: <p>I'm using the <a href="https://docs.microsoft.com/en-us/aspnet/core/security/data-protection/configuration/overview?view=aspnetcore-2.1&amp;tabs=aspnetcore2x" rel="noreferrer">ASP.NET Core Data Protection system</a> to encrypt data with Application A and decrypt it with Application B.</p>
  <p>Encryption and decryption both work when run on the development machine, but when Application B is moved to the production machine it's no longer able to decrypt because the <a href="https://docs.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.dataprotection.dataprotectioncommonextensions.unprotect?view=aspnetcore-2.1" rel="noreferrer">IDataProtector.Unprotect</a> method throws an exception:</p>
  <blockquote>
  <p>System.InvalidOperationException: The key ring does not contain a
  valid default protection key. The data protection system cannot create
  a new key because auto-generation of keys is disabled.</p>
  </blockquote>
  <p>Here's the code I'm using to configure decryption in Application B:</p>
  <pre><code>sKeysPath = Path.Combine(Path.GetDirectoryName(Assembly.GetExecutingAssembly().Location), &quot;Keys&quot;);
  
  services.AddDataProtection()
      .SetApplicationName(&quot;My Application&quot;) // Application A sets this same name
      .PersistKeysToFileSystem(new DirectoryInfo(sKeysPath))
      .ProtectKeysWithCertificate(&quot;634D3F23...&quot;)
      //.ProtectKeysWithCertificate(x509Certificate2) // I've tried using an X509 certificate parameter but it gives the same result as providing the thumbprint of the one in the certificate store
      .DisableAutomaticKeyGeneration(); // Application A is the master key generator so do not generate keys
  </code></pre>
  <p>The production machine does contain the same Keys folder (with .pfx and .xml files) and same keys installed in the Windows certificate store.</p>
  <p>As I understand it, by providing the certificate file to the Data Protection system, it should work on any machine and not be binded to a specific machine or Windows user. Is that assumption incorrect or is there an issue with the way I'm performing decryption?</p>
  <p>Here are some more detailed logging messages:</p>
  <blockquote>
  <p><code>2018-06-13 16:32:32.6750 | TRACE | Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector | 5 | Performing unprotect operation to key {846541...} with purposes ('My Application', 'My Purpose').</code></p>
  <p><code>2018-06-13 16:32:32.6750 | DEBUG | Microsoft.AspNetCore.DataProtection.Repositories.FileSystemXmlRepository | 37 | Reading data from file 'C:\inetpub\wwwroot\My Website\Keys\key-846541....xml'.</code></p>
  <p><code>2018-06-13 16:32:32.6750 | DEBUG | Microsoft.AspNetCore.DataProtection.KeyManagement.XmlKeyManager | 18 | Found key {846541...}.</code></p>
  <p><code>2018-06-13 16:32:32.6750 | DEBUG | Microsoft.AspNetCore.DataProtection.KeyManagement.DefaultKeyResolver | 13 | Considering key {846541...} with expiration date 2038-01-18 20:54:13Z as default key.</code></p>
  <p><code>2018-06-13 16:32:32.6750 | DEBUG | Microsoft.AspNetCore.DataProtection.TypeForwardingActivator | Forwarded activator type request from Microsoft.AspNetCore.DataProtection.XmlEncryption.EncryptedXmlDecryptor, Microsoft.AspNetCore.DataProtection, Version=2.1.0.0, Culture=neutral, PublicKeyToken=adb9793829ddae60 to Microsoft.AspNetCore.DataProtection.XmlEncryption.EncryptedXmlDecryptor, Microsoft.AspNetCore.DataProtection, Culture=neutral, PublicKeyToken=adb9793829ddae60</code></p>
  <p><code>2018-06-13 16:32:32.7051 | ERROR | Microsoft.AspNetCore.DataProtection.KeyManagement.XmlKeyManager | 24 | An exception occurred while processing the key element '&lt;key id=&quot;846541...&quot; version=&quot;1&quot; /&gt;'. Internal.Cryptography.CryptoThrowHelper+WindowsCryptographicException: Keyset does not exist</code></p>
  <p><code>2018-06-13 16:32:32.7051 | TRACE | Microsoft.AspNetCore.DataProtection.KeyManagement.XmlKeyManager | 25 | An exception occurred while processing the key element '&lt;key id=&quot;846541...&quot; version=&quot;1&quot; /&gt;...</code></p>
  <p><code>2018-06-13 16:32:32.7051 | WARN | Microsoft.AspNetCore.DataProtection.KeyManagement.DefaultKeyResolver | 12 | Key {846541...} is ineligible to be the default key because its CreateEncryptor method failed. Internal.Cryptography.CryptoThrowHelper+WindowsCryptographicException: Keyset does not exist</code></p>
  <p><code>2018-06-13 16:32:32.7051 | DEBUG | Microsoft.AspNetCore.DataProtection.KeyManagement.DefaultKeyResolver | 14 | Key {846541...} is no longer under consideration as default key because it is expired, revoked, or cannot be deciphered.</code></p>
  <p><code>2018-06-13 16:32:32.7051 | DEBUG | Microsoft.AspNetCore.DataProtection.KeyManagement.DefaultKeyResolver | 53 | Repository contains no viable default key. Caller should generate a key with immediate activation.</code></p>
  <p><code>2018-06-13 16:32:32.7051 | DEBUG | Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingProvider | 57 | Policy resolution states that a new key should be added to the key ring.</code></p>
  <p><code>2018-06-13 16:32:32.7051 | ERROR | Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingProvider | 49 | The key ring does not contain a valid default key, and the key manager is configured with auto-generation of keys disabled.</code></p>
  <p><code>2018-06-13 16:32:32.7051 | ERROR | Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingProvider | 48 | An error occurred while reading the key ring. System.InvalidOperationException: The key ring does not contain a valid default protection key. The data protection system cannot create a new key because auto-generation of keys is disabled.</code></p>
  </blockquote>