Skip to content

Improve compat for low rights users loading CAPI machine keys via PFX #119124

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
bartonjs merged 7 commits into from
Aug 28, 2025
Merged

Improve compat for low rights users loading CAPI machine keys via PFX #119124

bartonjs merged 7 commits into from
Aug 28, 2025

Conversation

@bartonjs
Copy link
Member

@bartonjs bartonjs commented Aug 26, 2025

  1. Windows exhibits different behaviors between no provider attribute with PKCS12_PREFER_CNG_KSP than with specifying the KSP, so always specify the KSP instead of deleting the attribute.

  2. Let's stop messing with provider attributes on non-Windows, since this change is making them more expensive.

  3. If PreserveStorageProvider is false, the key would go to a machine store, the user can't write to the CNG machine store, and the key is from a known CAPI provider, don't upgrade it to CNG.

Fixes #117798.

@bartonjs
Improve compat for low rights users loading CAPI machine keys via PFX
e31eaac 
1) Windows exhibits different behaviors between no provider attribute with PKCS12_PREFER_CNG_KSP than with specifying the KSP, so always specify the KSP.

2) Let's stop messing with provider attributes on non-Windows, since this change is making them more expensive.

3) If PreserveStorageProvider is false, the key would go to a machine store, the user can't write to the CNG machine store, and the key is from a known CAPI provider, don't upgrade it to CNG.
@bartonjs bartonjs self-assigned this Aug 26, 2025
Copilot AI review requested due to automatic review settings August 26, 2025 23:22
@dotnet-policy-service
Copy link
Contributor

dotnet-policy-service bot commented Aug 26, 2025

Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

Copilot AI reviewed Aug 26, 2025
View reviewed changes
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR improves compatibility for low-privilege users loading CAPI machine keys via PFX files on Windows by modifying the cryptographic provider selection logic. The changes address permission issues where users cannot write to CNG machine stores but can write to CAPI machine stores.

Key changes:

  • Remove default PKCS12_PREFER_CNG_KSP flag initialization and let Windows handle provider selection naturally
  • Add intelligent provider selection logic that detects CAPI providers and user permissions
  • Restrict provider attribute processing to Windows-only platforms for performance

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File Description
X509CertificateLoader.Windows.cs Removes default CNG preference flag to allow natural Windows provider selection
X509CertificateLoader.Pkcs12.cs Adds comprehensive provider selection logic, permission checking, and Windows-specific attribute processing

@bartonjs
Copy link
Member Author

bartonjs commented Aug 26, 2025

Tested with {Default, User, Machine, User|Machine} x {0, Exportable} with all RSA type providers.

The low rights user fails for MS_DEFAULT_PROV because it prohibits RSA "Exchange" keys over 1024-bit. (Windows says Access Denied, not us)

Admin, with change:

Details 
C:\git\bartonjs\runtime\artifacts\bin\testhost\net10.0-windows-Debug-x64\shared\Microsoft.NETCore.App\10.0.0\system.security.cryptography.dll
Testing Microsoft Base Cryptographic Provider v1.0
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CNG Machine
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CNG Machine
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
Testing Microsoft Base Cryptographic Provider v1.0, with MachineKey
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CNG Machine
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CNG Machine
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CNG Machine
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CNG Machine
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
Testing Microsoft Enhanced Cryptographic Provider v1.0
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
Testing Microsoft Enhanced Cryptographic Provider v1.0, with MachineKey
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
Testing Microsoft Strong Cryptographic Provider
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Strong Cryptographic Provider]
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Strong Cryptographic Provider]
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Strong Cryptographic Provider]
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Strong Cryptographic Provider]
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Strong Cryptographic Provider]
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Strong Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Strong Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Strong Cryptographic Provider]
Testing Microsoft Strong Cryptographic Provider, with MachineKey
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Strong Cryptographic Provider]
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Strong Cryptographic Provider]
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Strong Cryptographic Provider]
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Strong Cryptographic Provider]
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Strong Cryptographic Provider]
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Strong Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Strong Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Strong Cryptographic Provider]
Testing Microsoft RSA Signature Cryptographic Provider
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA Signature Cryptographic Provider]
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA Signature Cryptographic Provider]
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA Signature Cryptographic Provider]
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA Signature Cryptographic Provider]
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft RSA Signature Cryptographic Provider]
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft RSA Signature Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA Signature Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA Signature Cryptographic Provider]
Testing Microsoft RSA Signature Cryptographic Provider, with MachineKey
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft RSA Signature Cryptographic Provider]
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft RSA Signature Cryptographic Provider]
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA Signature Cryptographic Provider]
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA Signature Cryptographic Provider]
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft RSA Signature Cryptographic Provider]
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft RSA Signature Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA Signature Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA Signature Cryptographic Provider]
Testing Microsoft RSA SChannel Cryptographic Provider
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA SChannel Cryptographic Provider]
Testing Microsoft RSA SChannel Cryptographic Provider, with MachineKey
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA SChannel Cryptographic Provider]
Testing Microsoft Enhanced RSA and AES Cryptographic Provider
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced RSA and AES Cryptographic Provider]
Testing Microsoft Enhanced RSA and AES Cryptographic Provider, with MachineKey
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced RSA and AES Cryptographic Provider]
Testing Microsoft Enhanced RSA and AES Cryptographic Provider (Prototype)
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
Testing Microsoft Enhanced RSA and AES Cryptographic Provider (Prototype), with MachineKey
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]

Low-rights user, with change:

Details 
C:\git\bartonjs\runtime\artifacts\bin\testhost\net10.0-windows-Debug-x64\shared\Microsoft.NETCore.App\10.0.0\system.security.cryptography.dll
Testing Microsoft Base Cryptographic Provider v1.0
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
    PreserveStorageProvider=true
      PKCS#12 Import Failed: System.Security.Cryptography.CryptographicException: Access denied.
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ImportPfx(ReadOnlySpan`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags) in C:\git\bartonjs\runtime\src\libraries\System.Security.Cryptography\src\System\Security\Cryptography\X509Certificates\X509CertificateLoader.Windows.cs:line 274
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ImportPfx(BagState& bagState, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags) in C:\git\bartonjs\runtime\src\libraries\System.Security.Cryptography\src\System\Security\Cryptography\X509Certificates\X509CertificateLoader.Windows.cs:line 227
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(BagState& bagState, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags) in C:\git\bartonjs\runtime\src\libraries\System.Security.Cryptography\src\System\Security\Cryptography\X509Certificates\X509CertificateLoader.Windows.cs:line 79
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(ReadOnlyMemory`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits) in C:\git\bartonjs\runtime\src\libraries\Common\src\System\Security\Cryptography\X509Certificates\X509CertificateLoader.Pkcs12.cs:line 81
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(Byte[] data, String password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits) in C:\git\bartonjs\runtime\src\libraries\Common\src\System\Security\Cryptography\X509Certificates\X509CertificateLoader.cs:line 138
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
    PreserveStorageProvider=true
      PKCS#12 Import Failed: System.Security.Cryptography.CryptographicException: Access denied.
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ImportPfx(ReadOnlySpan`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags) in C:\git\bartonjs\runtime\src\libraries\System.Security.Cryptography\src\System\Security\Cryptography\X509Certificates\X509CertificateLoader.Windows.cs:line 274
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ImportPfx(BagState& bagState, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags) in C:\git\bartonjs\runtime\src\libraries\System.Security.Cryptography\src\System\Security\Cryptography\X509Certificates\X509CertificateLoader.Windows.cs:line 227
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(BagState& bagState, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags) in C:\git\bartonjs\runtime\src\libraries\System.Security.Cryptography\src\System\Security\Cryptography\X509Certificates\X509CertificateLoader.Windows.cs:line 79
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(ReadOnlyMemory`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits) in C:\git\bartonjs\runtime\src\libraries\Common\src\System\Security\Cryptography\X509Certificates\X509CertificateLoader.Pkcs12.cs:line 81
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(Byte[] data, String password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits) in C:\git\bartonjs\runtime\src\libraries\Common\src\System\Security\Cryptography\X509Certificates\X509CertificateLoader.cs:line 138
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
Testing Microsoft Base Cryptographic Provider v1.0, with MachineKey
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
    PreserveStorageProvider=true
      PKCS#12 Import Failed: System.Security.Cryptography.CryptographicException: Access denied.
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ImportPfx(ReadOnlySpan`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags) in C:\git\bartonjs\runtime\src\libraries\System.Security.Cryptography\src\System\Security\Cryptography\X509Certificates\X509CertificateLoader.Windows.cs:line 274
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ImportPfx(BagState& bagState, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags) in C:\git\bartonjs\runtime\src\libraries\System.Security.Cryptography\src\System\Security\Cryptography\X509Certificates\X509CertificateLoader.Windows.cs:line 227
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(BagState& bagState, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags) in C:\git\bartonjs\runtime\src\libraries\System.Security.Cryptography\src\System\Security\Cryptography\X509Certificates\X509CertificateLoader.Windows.cs:line 79
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(ReadOnlyMemory`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits) in C:\git\bartonjs\runtime\src\libraries\Common\src\System\Security\Cryptography\X509Certificates\X509CertificateLoader.Pkcs12.cs:line 81
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(Byte[] data, String password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits) in C:\git\bartonjs\runtime\src\libraries\Common\src\System\Security\Cryptography\X509Certificates\X509CertificateLoader.cs:line 138
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
    PreserveStorageProvider=true
      PKCS#12 Import Failed: System.Security.Cryptography.CryptographicException: Access denied.
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ImportPfx(ReadOnlySpan`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags) in C:\git\bartonjs\runtime\src\libraries\System.Security.Cryptography\src\System\Security\Cryptography\X509Certificates\X509CertificateLoader.Windows.cs:line 274
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ImportPfx(BagState& bagState, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags) in C:\git\bartonjs\runtime\src\libraries\System.Security.Cryptography\src\System\Security\Cryptography\X509Certificates\X509CertificateLoader.Windows.cs:line 227
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(BagState& bagState, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags) in C:\git\bartonjs\runtime\src\libraries\System.Security.Cryptography\src\System\Security\Cryptography\X509Certificates\X509CertificateLoader.Windows.cs:line 79
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(ReadOnlyMemory`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits) in C:\git\bartonjs\runtime\src\libraries\Common\src\System\Security\Cryptography\X509Certificates\X509CertificateLoader.Pkcs12.cs:line 81
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(Byte[] data, String password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits) in C:\git\bartonjs\runtime\src\libraries\Common\src\System\Security\Cryptography\X509Certificates\X509CertificateLoader.cs:line 138
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
    PreserveStorageProvider=true
      PKCS#12 Import Failed: System.Security.Cryptography.CryptographicException: Access denied.
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ImportPfx(ReadOnlySpan`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags) in C:\git\bartonjs\runtime\src\libraries\System.Security.Cryptography\src\System\Security\Cryptography\X509Certificates\X509CertificateLoader.Windows.cs:line 274
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ImportPfx(BagState& bagState, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags) in C:\git\bartonjs\runtime\src\libraries\System.Security.Cryptography\src\System\Security\Cryptography\X509Certificates\X509CertificateLoader.Windows.cs:line 227
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(BagState& bagState, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags) in C:\git\bartonjs\runtime\src\libraries\System.Security.Cryptography\src\System\Security\Cryptography\X509Certificates\X509CertificateLoader.Windows.cs:line 79
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(ReadOnlyMemory`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits) in C:\git\bartonjs\runtime\src\libraries\Common\src\System\Security\Cryptography\X509Certificates\X509CertificateLoader.Pkcs12.cs:line 81
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(Byte[] data, String password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits) in C:\git\bartonjs\runtime\src\libraries\Common\src\System\Security\Cryptography\X509Certificates\X509CertificateLoader.cs:line 138
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
    PreserveStorageProvider=true
      PKCS#12 Import Failed: System.Security.Cryptography.CryptographicException: Access denied.
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ImportPfx(ReadOnlySpan`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags) in C:\git\bartonjs\runtime\src\libraries\System.Security.Cryptography\src\System\Security\Cryptography\X509Certificates\X509CertificateLoader.Windows.cs:line 274
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ImportPfx(BagState& bagState, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags) in C:\git\bartonjs\runtime\src\libraries\System.Security.Cryptography\src\System\Security\Cryptography\X509Certificates\X509CertificateLoader.Windows.cs:line 227
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(BagState& bagState, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags) in C:\git\bartonjs\runtime\src\libraries\System.Security.Cryptography\src\System\Security\Cryptography\X509Certificates\X509CertificateLoader.Windows.cs:line 79
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(ReadOnlyMemory`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits) in C:\git\bartonjs\runtime\src\libraries\Common\src\System\Security\Cryptography\X509Certificates\X509CertificateLoader.Pkcs12.cs:line 81
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(Byte[] data, String password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits) in C:\git\bartonjs\runtime\src\libraries\Common\src\System\Security\Cryptography\X509Certificates\X509CertificateLoader.cs:line 138
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
Testing Microsoft Enhanced Cryptographic Provider v1.0
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
Testing Microsoft Enhanced Cryptographic Provider v1.0, with MachineKey
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
Testing Microsoft Strong Cryptographic Provider
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Strong Cryptographic Provider]
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Strong Cryptographic Provider]
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Strong Cryptographic Provider]
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Strong Cryptographic Provider]
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Strong Cryptographic Provider]
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Strong Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Strong Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Strong Cryptographic Provider]
Testing Microsoft Strong Cryptographic Provider, with MachineKey
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Strong Cryptographic Provider]
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Strong Cryptographic Provider]
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Strong Cryptographic Provider]
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Strong Cryptographic Provider]
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Strong Cryptographic Provider]
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Strong Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Strong Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Strong Cryptographic Provider]
Testing Microsoft RSA Signature Cryptographic Provider
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA Signature Cryptographic Provider]
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA Signature Cryptographic Provider]
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA Signature Cryptographic Provider]
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA Signature Cryptographic Provider]
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA Signature Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA Signature Cryptographic Provider]
Testing Microsoft RSA Signature Cryptographic Provider, with MachineKey
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA Signature Cryptographic Provider]
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA Signature Cryptographic Provider]
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA Signature Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA Signature Cryptographic Provider]
Testing Microsoft RSA SChannel Cryptographic Provider
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
    PreserveStorageProvider=true
      CAPI Machine [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
    PreserveStorageProvider=true
      CAPI Machine [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA SChannel Cryptographic Provider]
Testing Microsoft RSA SChannel Cryptographic Provider, with MachineKey
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
    PreserveStorageProvider=true
      CAPI Machine [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
    PreserveStorageProvider=true
      CAPI Machine [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
    PreserveStorageProvider=true
      CAPI Machine [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
    PreserveStorageProvider=true
      CAPI Machine [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA SChannel Cryptographic Provider]
Testing Microsoft Enhanced RSA and AES Cryptographic Provider
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced RSA and AES Cryptographic Provider]
Testing Microsoft Enhanced RSA and AES Cryptographic Provider, with MachineKey
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced RSA and AES Cryptographic Provider]
Testing Microsoft Enhanced RSA and AES Cryptographic Provider (Prototype)
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
Testing Microsoft Enhanced RSA and AES Cryptographic Provider (Prototype), with MachineKey
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]

Admin user, 10-p7:

Details 
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.0-preview.7.25380.108\system.security.cryptography.dll
Testing Microsoft Base Cryptographic Provider v1.0
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CNG Machine
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CNG Machine
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
Testing Microsoft Base Cryptographic Provider v1.0, with MachineKey
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CNG Machine
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CNG Machine
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CNG Machine
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CNG Machine
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
Testing Microsoft Enhanced Cryptographic Provider v1.0
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
Testing Microsoft Enhanced Cryptographic Provider v1.0, with MachineKey
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
Testing Microsoft Strong Cryptographic Provider
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Strong Cryptographic Provider]
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Strong Cryptographic Provider]
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Strong Cryptographic Provider]
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Strong Cryptographic Provider]
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Strong Cryptographic Provider]
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Strong Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Strong Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Strong Cryptographic Provider]
Testing Microsoft Strong Cryptographic Provider, with MachineKey
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Strong Cryptographic Provider]
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Strong Cryptographic Provider]
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Strong Cryptographic Provider]
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Strong Cryptographic Provider]
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Strong Cryptographic Provider]
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Strong Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Strong Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Strong Cryptographic Provider]
Testing Microsoft RSA Signature Cryptographic Provider
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA Signature Cryptographic Provider]
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA Signature Cryptographic Provider]
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA Signature Cryptographic Provider]
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA Signature Cryptographic Provider]
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft RSA Signature Cryptographic Provider]
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft RSA Signature Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA Signature Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA Signature Cryptographic Provider]
Testing Microsoft RSA Signature Cryptographic Provider, with MachineKey
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft RSA Signature Cryptographic Provider]
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft RSA Signature Cryptographic Provider]
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA Signature Cryptographic Provider]
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA Signature Cryptographic Provider]
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft RSA Signature Cryptographic Provider]
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft RSA Signature Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA Signature Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA Signature Cryptographic Provider]
Testing Microsoft RSA SChannel Cryptographic Provider
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA SChannel Cryptographic Provider]
Testing Microsoft RSA SChannel Cryptographic Provider, with MachineKey
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA SChannel Cryptographic Provider]
Testing Microsoft Enhanced RSA and AES Cryptographic Provider
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced RSA and AES Cryptographic Provider]
Testing Microsoft Enhanced RSA and AES Cryptographic Provider, with MachineKey
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced RSA and AES Cryptographic Provider]
Testing Microsoft Enhanced RSA and AES Cryptographic Provider (Prototype)
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CNG Machine
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CNG Machine
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
Testing Microsoft Enhanced RSA and AES Cryptographic Provider (Prototype), with MachineKey
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CNG Machine
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CNG Machine
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CNG Machine
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG Machine
    PreserveStorageProvider=true
      CNG Machine
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User

Low-rights user, 10-p7:

Details 
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.0-preview.7.25380.108\system.security.cryptography.dll
Testing Microsoft Base Cryptographic Provider v1.0
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      Error accessing private key: System.Security.Cryptography.CryptographicException: Keyset does not exist
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider, CngKeyOpenOptions openOptions)
   at System.Security.Cryptography.X509Certificates.CertificatePal.GetPrivateKey[T](Func`2 createCsp, Func`2 createCng)
   at System.Security.Cryptography.X509Certificates.CertificateExtensionsCommon.GetPrivateKey[T](X509Certificate2 certificate, Predicate`1 matchesConstraints)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
    PreserveStorageProvider=true
      PKCS#12 Import Failed: System.Security.Cryptography.CryptographicException: Access denied.
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ImportPfx(ReadOnlySpan`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ImportPfx(BagState& bagState, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(BagState& bagState, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(ReadOnlyMemory`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(Byte[] data, String password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      Error accessing private key: System.Security.Cryptography.CryptographicException: Keyset does not exist
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider, CngKeyOpenOptions openOptions)
   at System.Security.Cryptography.X509Certificates.CertificatePal.GetPrivateKey[T](Func`2 createCsp, Func`2 createCng)
   at System.Security.Cryptography.X509Certificates.CertificateExtensionsCommon.GetPrivateKey[T](X509Certificate2 certificate, Predicate`1 matchesConstraints)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
    PreserveStorageProvider=true
      PKCS#12 Import Failed: System.Security.Cryptography.CryptographicException: Access denied.
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ImportPfx(ReadOnlySpan`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ImportPfx(BagState& bagState, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(BagState& bagState, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(ReadOnlyMemory`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(Byte[] data, String password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
Testing Microsoft Base Cryptographic Provider v1.0, with MachineKey
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      Error accessing private key: System.Security.Cryptography.CryptographicException: Keyset does not exist
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider, CngKeyOpenOptions openOptions)
   at System.Security.Cryptography.X509Certificates.CertificatePal.GetPrivateKey[T](Func`2 createCsp, Func`2 createCng)
   at System.Security.Cryptography.X509Certificates.CertificateExtensionsCommon.GetPrivateKey[T](X509Certificate2 certificate, Predicate`1 matchesConstraints)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
    PreserveStorageProvider=true
      PKCS#12 Import Failed: System.Security.Cryptography.CryptographicException: Access denied.
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ImportPfx(ReadOnlySpan`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ImportPfx(BagState& bagState, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(BagState& bagState, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(ReadOnlyMemory`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(Byte[] data, String password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
  Testing with flags: Exportable
    PreserveStorageProvider=false
      Error accessing private key: System.Security.Cryptography.CryptographicException: Keyset does not exist
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider, CngKeyOpenOptions openOptions)
   at System.Security.Cryptography.X509Certificates.CertificatePal.GetPrivateKey[T](Func`2 createCsp, Func`2 createCng)
   at System.Security.Cryptography.X509Certificates.CertificateExtensionsCommon.GetPrivateKey[T](X509Certificate2 certificate, Predicate`1 matchesConstraints)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
    PreserveStorageProvider=true
      PKCS#12 Import Failed: System.Security.Cryptography.CryptographicException: Access denied.
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ImportPfx(ReadOnlySpan`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ImportPfx(BagState& bagState, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(BagState& bagState, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(ReadOnlyMemory`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(Byte[] data, String password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      Error accessing private key: System.Security.Cryptography.CryptographicException: Keyset does not exist
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider, CngKeyOpenOptions openOptions)
   at System.Security.Cryptography.X509Certificates.CertificatePal.GetPrivateKey[T](Func`2 createCsp, Func`2 createCng)
   at System.Security.Cryptography.X509Certificates.CertificateExtensionsCommon.GetPrivateKey[T](X509Certificate2 certificate, Predicate`1 matchesConstraints)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
    PreserveStorageProvider=true
      PKCS#12 Import Failed: System.Security.Cryptography.CryptographicException: Access denied.
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ImportPfx(ReadOnlySpan`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ImportPfx(BagState& bagState, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(BagState& bagState, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(ReadOnlyMemory`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(Byte[] data, String password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      Error accessing private key: System.Security.Cryptography.CryptographicException: Keyset does not exist
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider, CngKeyOpenOptions openOptions)
   at System.Security.Cryptography.X509Certificates.CertificatePal.GetPrivateKey[T](Func`2 createCsp, Func`2 createCng)
   at System.Security.Cryptography.X509Certificates.CertificateExtensionsCommon.GetPrivateKey[T](X509Certificate2 certificate, Predicate`1 matchesConstraints)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
    PreserveStorageProvider=true
      PKCS#12 Import Failed: System.Security.Cryptography.CryptographicException: Access denied.
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ImportPfx(ReadOnlySpan`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ImportPfx(BagState& bagState, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(BagState& bagState, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(ReadOnlyMemory`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(Byte[] data, String password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
Testing Microsoft Enhanced Cryptographic Provider v1.0
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      Error accessing private key: System.Security.Cryptography.CryptographicException: Keyset does not exist
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider, CngKeyOpenOptions openOptions)
   at System.Security.Cryptography.X509Certificates.CertificatePal.GetPrivateKey[T](Func`2 createCsp, Func`2 createCng)
   at System.Security.Cryptography.X509Certificates.CertificateExtensionsCommon.GetPrivateKey[T](X509Certificate2 certificate, Predicate`1 matchesConstraints)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      Error accessing private key: System.Security.Cryptography.CryptographicException: Keyset does not exist
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider, CngKeyOpenOptions openOptions)
   at System.Security.Cryptography.X509Certificates.CertificatePal.GetPrivateKey[T](Func`2 createCsp, Func`2 createCng)
   at System.Security.Cryptography.X509Certificates.CertificateExtensionsCommon.GetPrivateKey[T](X509Certificate2 certificate, Predicate`1 matchesConstraints)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
Testing Microsoft Enhanced Cryptographic Provider v1.0, with MachineKey
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      Error accessing private key: System.Security.Cryptography.CryptographicException: Keyset does not exist
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider, CngKeyOpenOptions openOptions)
   at System.Security.Cryptography.X509Certificates.CertificatePal.GetPrivateKey[T](Func`2 createCsp, Func`2 createCng)
   at System.Security.Cryptography.X509Certificates.CertificateExtensionsCommon.GetPrivateKey[T](X509Certificate2 certificate, Predicate`1 matchesConstraints)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: Exportable
    PreserveStorageProvider=false
      Error accessing private key: System.Security.Cryptography.CryptographicException: Keyset does not exist
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider, CngKeyOpenOptions openOptions)
   at System.Security.Cryptography.X509Certificates.CertificatePal.GetPrivateKey[T](Func`2 createCsp, Func`2 createCng)
   at System.Security.Cryptography.X509Certificates.CertificateExtensionsCommon.GetPrivateKey[T](X509Certificate2 certificate, Predicate`1 matchesConstraints)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      Error accessing private key: System.Security.Cryptography.CryptographicException: Keyset does not exist
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider, CngKeyOpenOptions openOptions)
   at System.Security.Cryptography.X509Certificates.CertificatePal.GetPrivateKey[T](Func`2 createCsp, Func`2 createCng)
   at System.Security.Cryptography.X509Certificates.CertificateExtensionsCommon.GetPrivateKey[T](X509Certificate2 certificate, Predicate`1 matchesConstraints)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      Error accessing private key: System.Security.Cryptography.CryptographicException: Keyset does not exist
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider, CngKeyOpenOptions openOptions)
   at System.Security.Cryptography.X509Certificates.CertificatePal.GetPrivateKey[T](Func`2 createCsp, Func`2 createCng)
   at System.Security.Cryptography.X509Certificates.CertificateExtensionsCommon.GetPrivateKey[T](X509Certificate2 certificate, Predicate`1 matchesConstraints)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced Cryptographic Provider v1.0]
Testing Microsoft Strong Cryptographic Provider
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Strong Cryptographic Provider]
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Strong Cryptographic Provider]
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Strong Cryptographic Provider]
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Strong Cryptographic Provider]
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      Error accessing private key: System.Security.Cryptography.CryptographicException: Keyset does not exist
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider, CngKeyOpenOptions openOptions)
   at System.Security.Cryptography.X509Certificates.CertificatePal.GetPrivateKey[T](Func`2 createCsp, Func`2 createCng)
   at System.Security.Cryptography.X509Certificates.CertificateExtensionsCommon.GetPrivateKey[T](X509Certificate2 certificate, Predicate`1 matchesConstraints)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Strong Cryptographic Provider]
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      Error accessing private key: System.Security.Cryptography.CryptographicException: Keyset does not exist
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider, CngKeyOpenOptions openOptions)
   at System.Security.Cryptography.X509Certificates.CertificatePal.GetPrivateKey[T](Func`2 createCsp, Func`2 createCng)
   at System.Security.Cryptography.X509Certificates.CertificateExtensionsCommon.GetPrivateKey[T](X509Certificate2 certificate, Predicate`1 matchesConstraints)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Strong Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Strong Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Strong Cryptographic Provider]
Testing Microsoft Strong Cryptographic Provider, with MachineKey
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      Error accessing private key: System.Security.Cryptography.CryptographicException: Keyset does not exist
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider, CngKeyOpenOptions openOptions)
   at System.Security.Cryptography.X509Certificates.CertificatePal.GetPrivateKey[T](Func`2 createCsp, Func`2 createCng)
   at System.Security.Cryptography.X509Certificates.CertificateExtensionsCommon.GetPrivateKey[T](X509Certificate2 certificate, Predicate`1 matchesConstraints)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Strong Cryptographic Provider]
  Testing with flags: Exportable
    PreserveStorageProvider=false
      Error accessing private key: System.Security.Cryptography.CryptographicException: Keyset does not exist
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider, CngKeyOpenOptions openOptions)
   at System.Security.Cryptography.X509Certificates.CertificatePal.GetPrivateKey[T](Func`2 createCsp, Func`2 createCng)
   at System.Security.Cryptography.X509Certificates.CertificateExtensionsCommon.GetPrivateKey[T](X509Certificate2 certificate, Predicate`1 matchesConstraints)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Strong Cryptographic Provider]
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Strong Cryptographic Provider]
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Strong Cryptographic Provider]
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      Error accessing private key: System.Security.Cryptography.CryptographicException: Keyset does not exist
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider, CngKeyOpenOptions openOptions)
   at System.Security.Cryptography.X509Certificates.CertificatePal.GetPrivateKey[T](Func`2 createCsp, Func`2 createCng)
   at System.Security.Cryptography.X509Certificates.CertificateExtensionsCommon.GetPrivateKey[T](X509Certificate2 certificate, Predicate`1 matchesConstraints)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Strong Cryptographic Provider]
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      Error accessing private key: System.Security.Cryptography.CryptographicException: Keyset does not exist
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider, CngKeyOpenOptions openOptions)
   at System.Security.Cryptography.X509Certificates.CertificatePal.GetPrivateKey[T](Func`2 createCsp, Func`2 createCng)
   at System.Security.Cryptography.X509Certificates.CertificateExtensionsCommon.GetPrivateKey[T](X509Certificate2 certificate, Predicate`1 matchesConstraints)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Strong Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Strong Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Strong Cryptographic Provider]
Testing Microsoft RSA Signature Cryptographic Provider
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA Signature Cryptographic Provider]
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA Signature Cryptographic Provider]
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA Signature Cryptographic Provider]
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA Signature Cryptographic Provider]
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      Error accessing private key: System.Security.Cryptography.CryptographicException: Keyset does not exist
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider, CngKeyOpenOptions openOptions)
   at System.Security.Cryptography.X509Certificates.CertificatePal.GetPrivateKey[T](Func`2 createCsp, Func`2 createCng)
   at System.Security.Cryptography.X509Certificates.CertificateExtensionsCommon.GetPrivateKey[T](X509Certificate2 certificate, Predicate`1 matchesConstraints)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
    PreserveStorageProvider=true
      PKCS#12 Import Failed: System.Security.Cryptography.CryptographicException: Access denied.
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ImportPfx(ReadOnlySpan`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ImportPfx(BagState& bagState, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(BagState& bagState, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(ReadOnlyMemory`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(Byte[] data, String password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      Error accessing private key: System.Security.Cryptography.CryptographicException: Keyset does not exist
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider, CngKeyOpenOptions openOptions)
   at System.Security.Cryptography.X509Certificates.CertificatePal.GetPrivateKey[T](Func`2 createCsp, Func`2 createCng)
   at System.Security.Cryptography.X509Certificates.CertificateExtensionsCommon.GetPrivateKey[T](X509Certificate2 certificate, Predicate`1 matchesConstraints)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
    PreserveStorageProvider=true
      PKCS#12 Import Failed: System.Security.Cryptography.CryptographicException: Access denied.
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ImportPfx(ReadOnlySpan`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ImportPfx(BagState& bagState, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(BagState& bagState, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(ReadOnlyMemory`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(Byte[] data, String password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA Signature Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA Signature Cryptographic Provider]
Testing Microsoft RSA Signature Cryptographic Provider, with MachineKey
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      Error accessing private key: System.Security.Cryptography.CryptographicException: Keyset does not exist
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider, CngKeyOpenOptions openOptions)
   at System.Security.Cryptography.X509Certificates.CertificatePal.GetPrivateKey[T](Func`2 createCsp, Func`2 createCng)
   at System.Security.Cryptography.X509Certificates.CertificateExtensionsCommon.GetPrivateKey[T](X509Certificate2 certificate, Predicate`1 matchesConstraints)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
    PreserveStorageProvider=true
      PKCS#12 Import Failed: System.Security.Cryptography.CryptographicException: Access denied.
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ImportPfx(ReadOnlySpan`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ImportPfx(BagState& bagState, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(BagState& bagState, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(ReadOnlyMemory`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(Byte[] data, String password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
  Testing with flags: Exportable
    PreserveStorageProvider=false
      Error accessing private key: System.Security.Cryptography.CryptographicException: Keyset does not exist
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider, CngKeyOpenOptions openOptions)
   at System.Security.Cryptography.X509Certificates.CertificatePal.GetPrivateKey[T](Func`2 createCsp, Func`2 createCng)
   at System.Security.Cryptography.X509Certificates.CertificateExtensionsCommon.GetPrivateKey[T](X509Certificate2 certificate, Predicate`1 matchesConstraints)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
    PreserveStorageProvider=true
      PKCS#12 Import Failed: System.Security.Cryptography.CryptographicException: Access denied.
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ImportPfx(ReadOnlySpan`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ImportPfx(BagState& bagState, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(BagState& bagState, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(ReadOnlyMemory`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(Byte[] data, String password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA Signature Cryptographic Provider]
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA Signature Cryptographic Provider]
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      Error accessing private key: System.Security.Cryptography.CryptographicException: Keyset does not exist
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider, CngKeyOpenOptions openOptions)
   at System.Security.Cryptography.X509Certificates.CertificatePal.GetPrivateKey[T](Func`2 createCsp, Func`2 createCng)
   at System.Security.Cryptography.X509Certificates.RSACertificateExtensions.GetRSAPrivateKey(X509Certificate2 certificate)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
    PreserveStorageProvider=true
      PKCS#12 Import Failed: System.Security.Cryptography.CryptographicException: Access denied.
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ImportPfx(ReadOnlySpan`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ImportPfx(BagState& bagState, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(BagState& bagState, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(ReadOnlyMemory`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(Byte[] data, String password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      Error accessing private key: System.Security.Cryptography.CryptographicException: Keyset does not exist
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider, CngKeyOpenOptions openOptions)
   at System.Security.Cryptography.X509Certificates.CertificatePal.GetPrivateKey[T](Func`2 createCsp, Func`2 createCng)
   at System.Security.Cryptography.X509Certificates.RSACertificateExtensions.GetRSAPrivateKey(X509Certificate2 certificate)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
    PreserveStorageProvider=true
      PKCS#12 Import Failed: System.Security.Cryptography.CryptographicException: Access denied.
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ImportPfx(ReadOnlySpan`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ImportPfx(BagState& bagState, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(BagState& bagState, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(ReadOnlyMemory`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(Byte[] data, String password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA Signature Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA Signature Cryptographic Provider]
Testing Microsoft RSA SChannel Cryptographic Provider
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      Error accessing private key: System.Security.Cryptography.CryptographicException: Keyset does not exist
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider, CngKeyOpenOptions openOptions)
   at System.Security.Cryptography.X509Certificates.CertificatePal.GetPrivateKey[T](Func`2 createCsp, Func`2 createCng)
   at System.Security.Cryptography.X509Certificates.RSACertificateExtensions.GetRSAPrivateKey(X509Certificate2 certificate)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
    PreserveStorageProvider=true
      CAPI Machine [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      Error accessing private key: System.Security.Cryptography.CryptographicException: Keyset does not exist
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider, CngKeyOpenOptions openOptions)
   at System.Security.Cryptography.X509Certificates.CertificatePal.GetPrivateKey[T](Func`2 createCsp, Func`2 createCng)
   at System.Security.Cryptography.X509Certificates.RSACertificateExtensions.GetRSAPrivateKey(X509Certificate2 certificate)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
    PreserveStorageProvider=true
      CAPI Machine [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA SChannel Cryptographic Provider]
Testing Microsoft RSA SChannel Cryptographic Provider, with MachineKey
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      Error accessing private key: System.Security.Cryptography.CryptographicException: Keyset does not exist
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider, CngKeyOpenOptions openOptions)
   at System.Security.Cryptography.X509Certificates.CertificatePal.GetPrivateKey[T](Func`2 createCsp, Func`2 createCng)
   at System.Security.Cryptography.X509Certificates.RSACertificateExtensions.GetRSAPrivateKey(X509Certificate2 certificate)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
    PreserveStorageProvider=true
      CAPI Machine [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: Exportable
    PreserveStorageProvider=false
      Error accessing private key: System.Security.Cryptography.CryptographicException: Keyset does not exist
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider, CngKeyOpenOptions openOptions)
   at System.Security.Cryptography.X509Certificates.CertificatePal.GetPrivateKey[T](Func`2 createCsp, Func`2 createCng)
   at System.Security.Cryptography.X509Certificates.RSACertificateExtensions.GetRSAPrivateKey(X509Certificate2 certificate)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
    PreserveStorageProvider=true
      CAPI Machine [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      Error accessing private key: System.Security.Cryptography.CryptographicException: Keyset does not exist
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider, CngKeyOpenOptions openOptions)
   at System.Security.Cryptography.X509Certificates.CertificatePal.GetPrivateKey[T](Func`2 createCsp, Func`2 createCng)
   at System.Security.Cryptography.X509Certificates.RSACertificateExtensions.GetRSAPrivateKey(X509Certificate2 certificate)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
    PreserveStorageProvider=true
      CAPI Machine [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      Error accessing private key: System.Security.Cryptography.CryptographicException: Keyset does not exist
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider, CngKeyOpenOptions openOptions)
   at System.Security.Cryptography.X509Certificates.CertificatePal.GetPrivateKey[T](Func`2 createCsp, Func`2 createCng)
   at System.Security.Cryptography.X509Certificates.RSACertificateExtensions.GetRSAPrivateKey(X509Certificate2 certificate)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
    PreserveStorageProvider=true
      CAPI Machine [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA SChannel Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft RSA SChannel Cryptographic Provider]
Testing Microsoft Enhanced RSA and AES Cryptographic Provider
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      Error accessing private key: System.Security.Cryptography.CryptographicException: Keyset does not exist
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider, CngKeyOpenOptions openOptions)
   at System.Security.Cryptography.X509Certificates.CertificatePal.GetPrivateKey[T](Func`2 createCsp, Func`2 createCng)
   at System.Security.Cryptography.X509Certificates.RSACertificateExtensions.GetRSAPrivateKey(X509Certificate2 certificate)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      Error accessing private key: System.Security.Cryptography.CryptographicException: Keyset does not exist
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider, CngKeyOpenOptions openOptions)
   at System.Security.Cryptography.X509Certificates.CertificatePal.GetPrivateKey[T](Func`2 createCsp, Func`2 createCng)
   at System.Security.Cryptography.X509Certificates.RSACertificateExtensions.GetRSAPrivateKey(X509Certificate2 certificate)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced RSA and AES Cryptographic Provider]
Testing Microsoft Enhanced RSA and AES Cryptographic Provider, with MachineKey
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      Error accessing private key: System.Security.Cryptography.CryptographicException: Keyset does not exist
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider, CngKeyOpenOptions openOptions)
   at System.Security.Cryptography.X509Certificates.CertificatePal.GetPrivateKey[T](Func`2 createCsp, Func`2 createCng)
   at System.Security.Cryptography.X509Certificates.RSACertificateExtensions.GetRSAPrivateKey(X509Certificate2 certificate)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: Exportable
    PreserveStorageProvider=false
      Error accessing private key: System.Security.Cryptography.CryptographicException: Keyset does not exist
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider, CngKeyOpenOptions openOptions)
   at System.Security.Cryptography.X509Certificates.CertificatePal.GetPrivateKey[T](Func`2 createCsp, Func`2 createCng)
   at System.Security.Cryptography.X509Certificates.RSACertificateExtensions.GetRSAPrivateKey(X509Certificate2 certificate)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      Error accessing private key: System.Security.Cryptography.CryptographicException: Keyset does not exist
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider, CngKeyOpenOptions openOptions)
   at System.Security.Cryptography.X509Certificates.CertificatePal.GetPrivateKey[T](Func`2 createCsp, Func`2 createCng)
   at System.Security.Cryptography.X509Certificates.RSACertificateExtensions.GetRSAPrivateKey(X509Certificate2 certificate)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      Error accessing private key: System.Security.Cryptography.CryptographicException: Keyset does not exist
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider, CngKeyOpenOptions openOptions)
   at System.Security.Cryptography.X509Certificates.CertificatePal.GetPrivateKey[T](Func`2 createCsp, Func`2 createCng)
   at System.Security.Cryptography.X509Certificates.RSACertificateExtensions.GetRSAPrivateKey(X509Certificate2 certificate)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
    PreserveStorageProvider=true
      CAPI Machine [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced RSA and AES Cryptographic Provider]
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CAPI User [Microsoft Enhanced RSA and AES Cryptographic Provider]
Testing Microsoft Enhanced RSA and AES Cryptographic Provider (Prototype)
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      Error accessing private key: System.Security.Cryptography.CryptographicException: Keyset does not exist
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider, CngKeyOpenOptions openOptions)
   at System.Security.Cryptography.X509Certificates.CertificatePal.GetPrivateKey[T](Func`2 createCsp, Func`2 createCng)
   at System.Security.Cryptography.X509Certificates.RSACertificateExtensions.GetRSAPrivateKey(X509Certificate2 certificate)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
    PreserveStorageProvider=true
      PKCS#12 Import Failed: System.Security.Cryptography.CryptographicException: Access denied.
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ImportPfx(ReadOnlySpan`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(BagState& bagState, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(ReadOnlyMemory`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(Byte[] data, String password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      Error accessing private key: System.Security.Cryptography.CryptographicException: Keyset does not exist
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider, CngKeyOpenOptions openOptions)
   at System.Security.Cryptography.X509Certificates.CertificatePal.GetPrivateKey[T](Func`2 createCsp, Func`2 createCng)
   at System.Security.Cryptography.X509Certificates.RSACertificateExtensions.GetRSAPrivateKey(X509Certificate2 certificate)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
    PreserveStorageProvider=true
      PKCS#12 Import Failed: System.Security.Cryptography.CryptographicException: Access denied.
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ImportPfx(ReadOnlySpan`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(BagState& bagState, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(ReadOnlyMemory`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(Byte[] data, String password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
Testing Microsoft Enhanced RSA and AES Cryptographic Provider (Prototype), with MachineKey
  Testing with flags: DefaultKeySet
    PreserveStorageProvider=false
      Error accessing private key: System.Security.Cryptography.CryptographicException: Keyset does not exist
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider, CngKeyOpenOptions openOptions)
   at System.Security.Cryptography.X509Certificates.CertificatePal.GetPrivateKey[T](Func`2 createCsp, Func`2 createCng)
   at System.Security.Cryptography.X509Certificates.RSACertificateExtensions.GetRSAPrivateKey(X509Certificate2 certificate)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
    PreserveStorageProvider=true
      PKCS#12 Import Failed: System.Security.Cryptography.CryptographicException: Access denied.
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ImportPfx(ReadOnlySpan`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(BagState& bagState, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(ReadOnlyMemory`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(Byte[] data, String password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
  Testing with flags: Exportable
    PreserveStorageProvider=false
      Error accessing private key: System.Security.Cryptography.CryptographicException: Keyset does not exist
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider, CngKeyOpenOptions openOptions)
   at System.Security.Cryptography.X509Certificates.CertificatePal.GetPrivateKey[T](Func`2 createCsp, Func`2 createCng)
   at System.Security.Cryptography.X509Certificates.RSACertificateExtensions.GetRSAPrivateKey(X509Certificate2 certificate)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
    PreserveStorageProvider=true
      PKCS#12 Import Failed: System.Security.Cryptography.CryptographicException: Access denied.
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ImportPfx(ReadOnlySpan`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(BagState& bagState, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(ReadOnlyMemory`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(Byte[] data, String password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
  Testing with flags: UserKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: UserKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: MachineKeySet
    PreserveStorageProvider=false
      Error accessing private key: System.Security.Cryptography.CryptographicException: Keyset does not exist
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider, CngKeyOpenOptions openOptions)
   at System.Security.Cryptography.X509Certificates.CertificatePal.GetPrivateKey[T](Func`2 createCsp, Func`2 createCng)
   at System.Security.Cryptography.X509Certificates.RSACertificateExtensions.GetRSAPrivateKey(X509Certificate2 certificate)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
    PreserveStorageProvider=true
      PKCS#12 Import Failed: System.Security.Cryptography.CryptographicException: Access denied.
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ImportPfx(ReadOnlySpan`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(BagState& bagState, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(ReadOnlyMemory`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(Byte[] data, String password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
  Testing with flags: MachineKeySet, Exportable
    PreserveStorageProvider=false
      Error accessing private key: System.Security.Cryptography.CryptographicException: Keyset does not exist
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider, CngKeyOpenOptions openOptions)
   at System.Security.Cryptography.X509Certificates.CertificatePal.GetPrivateKey[T](Func`2 createCsp, Func`2 createCng)
   at System.Security.Cryptography.X509Certificates.RSACertificateExtensions.GetRSAPrivateKey(X509Certificate2 certificate)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
    PreserveStorageProvider=true
      PKCS#12 Import Failed: System.Security.Cryptography.CryptographicException: Access denied.
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ImportPfx(ReadOnlySpan`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(BagState& bagState, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(ReadOnlyMemory`1 data, ReadOnlySpan`1 password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits)
   at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(Byte[] data, String password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits)
   at KeyPermissionsTest.Program.<RunTest>g__TestWithLimits|10_0(Byte[] pfx, Pkcs12LoaderLimits limits, X509KeyStorageFlags flags, String message)
  Testing with flags: UserKeySet, MachineKeySet
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User
  Testing with flags: UserKeySet, MachineKeySet, Exportable
    PreserveStorageProvider=false
      CNG User
    PreserveStorageProvider=true
      CNG User

Summary: Low rights machine key imports end up in MS_ENH_RSA_AES_PROV, rather than failing.

vcsjones
vcsjones reviewed Aug 26, 2025
View reviewed changes
Copy link
Member

@vcsjones vcsjones left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there any way we can add test coverage for this?

@bartonjs
Copy link
Member Author

bartonjs commented Aug 27, 2025

Is there any way we can add test coverage for this?

Not reliably for our CI, I don't think.

We could add a test that imports a MS_STRONG_PROV key with MachineKeySet and see that it succeeds, and that the only two acceptable providers are MS_KSP and PROV_RSA_AES_ENH... but I don't know that we have a way to make CI run a test as both an admin and an unprivileged user. (If you do, I'm happy to learn)

@vcsjones
Copy link
Member

vcsjones commented Aug 27, 2025 •
edited
Loading

If you do, I'm happy to learn

Not really. In theory it might be possible to teach RemoteExecutor how to do it by creating a process with CreateRestrictedToken but "go update arcade" is not a small lift. But that's only useful for dropping permissions.

@vcsjones
Copy link
Member

vcsjones commented Aug 27, 2025

We also have a few other tests conditioned on "IsElevated" or something like that. Some of the CNG tests have conditions for that for machine key writing. So we could write a test conditioned on that, but I don't know the odds that it will actually run in CI.

@bartonjs
Copy link
Member Author

bartonjs commented Aug 27, 2025

Is there any way we can add test coverage for this?

I added a test that shows that the expected provider is returned in all 16 cases.

Technically there are 32 cases (all the ones I added, but then again without a key having the machine key attribute), but I declare equivalency.

The PfxTests class passes as a low-rights user, meaning the new test passes as a low rights user.

vcsjones
vcsjones approved these changes Aug 28, 2025
View reviewed changes
Copy link
Member

@vcsjones vcsjones left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good minus some nonblocking suggestions.

vcsjones
vcsjones approved these changes Aug 28, 2025
View reviewed changes
Copy link
Member

@vcsjones vcsjones left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Now I got nothing.

This was referenced Aug 28, 2025
Open
Open
@bartonjs bartonjs merged commit ec67c4c into dotnet:main Aug 28, 2025
85 of 88 checks passed
@bartonjs
Copy link
Member Author

bartonjs commented Aug 28, 2025

/backport to release/10.0

@github-actions
Copy link
Contributor

github-actions bot commented Aug 28, 2025

Started backporting to release/10.0: https://github.com/dotnet/runtime/actions/runs/17304209626

@github-actions github-actions bot mentioned this pull request Aug 28, 2025
Merged
4 tasks
@bartonjs bartonjs mentioned this pull request Aug 28, 2025
Closed
@bartonjs bartonjs deleted the x509_machinekey_compat branch August 29, 2025 22:21
@github-actions github-actions bot locked and limited conversation to collaborators Sep 29, 2025
@bartonjs bartonjs added cryptographic-docs-impact Issues impacting cryptographic docs. Cleared and reused after documentation is updated each release. tracking This issue is tracking the completion of other related issues. labels Oct 2, 2025
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

Copilot code review Copilot Copilot left review comments

@vcsjones vcsjones vcsjones approved these changes

Assignees

@bartonjs bartonjs

Labels

area-System.Security cryptographic-docs-impact Issues impacting cryptographic docs. Cleared and reused after documentation is updated each release. tracking This issue is tracking the completion of other related issues.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Choice of Certificate Store: Bizarre breaking change in .NET or ASP.NET

2 participants

@bartonjs @vcsjones