I have been having this error in SharePoint show up often:

An unhandled exception occurred and the process was terminated.
Application ID: /LM/W3SVC/1640420947/ROOT
Process ID: 5788
Exception: System.Security.Cryptography.CryptographicException Message: Keyset does not exist

at System.Security.Cryptography.CryptographicException.ThrowCryptogaphicException(Int32 hr) at System.Security.Cryptography.SafeProvHandle._FreeCSP(IntPtr pProvCtx) at System.Security.Cryptography.SafeProvHandle.ReleaseHandle() at System.Runtime.InteropServices.SafeHandle.InternalFinalize() at System.Runtime.InteropServices.SafeHandle.Dispose(Boolean disposing) at System.Runtime.InteropServices.SafeHandle.Finalize()

I found this description of the issue:


However, that mentions that this error is occuring in 'OWSTIMER.EXE', where as in my process it is happening in 'w3wp.exe'. Would this mean that this is happening outside the SharePoint Timer services?

It happens enough to cause the 'Rapid Fail Protection' in IIS to trip and shutdown the app pool.


I had the same issue. I followed the advice found here. This page tells to give more rights to the private key of a certificate.

I could not find which one it was, so I set up auditing on c:\Users\All Users\Microsoft\Crypto\RSA\MachineKeys\, with Full Control on failure to Everyone. Then I enabled object access auditing on failure.

I reproduced the error and looked at the Security Windows logs and found 2 files that the identity of the app pool for my SP site could not access. I gave it Full Control (less should be enough, but I am lazy and this is a dev system) and no longer have this cryptography exception.

  • I will give it a shot, and let you know. – TeddyRuxpin Oct 4 '13 at 12:33

I started getting this error after configuring a MOSS 2010 web application to use Claims authentication.

Timores posted a great method for troubleshooting the issue and fixing it.

Since I knew that the issue started with Claims authentication, I ran mmc.exe and added the Certificate Add-In for the Local Computer.

Then, under Personal, I noticed that ForefrontIdentityManager certificate had been added recently. I then Right Clicked on it -> All Tasks -> Manage Private Keys. I gave read permissions to the IIS_IUSRS group. That group contained my MOSS application pool accounts in it. You can probably just grant permissions to the application pool account that handles claims authentication web application. Ensure the application pool account has at least read permissions to any certificates used by w3wp.exe.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.