title: “error:23076071:PKCS12 routines:PKCS12_parse:mac verify failure” when generating self signed certificate for Identity Server 4
body: <p>We're developing a microservices app on Kubernetes. One of the microservices is IdentityServer instance. Initially, I want to test the solution locally on Docker to make sure it works. For this purpose, I want to copy the certificate to appsettings.json. Eventually this value will be replaced by a Kubernetes secret. In my startup class this is how I'm trying to load my certificate:</p>
  
  <pre><code>services.AddIdentityServer()
       .AddSigningCredential(GetIdentityServerCertificate())
       .AddConfigurationStore(...
  
  
      private X509Certificate2 GetIdentityServerCertificate()
      {
          var clientSecret = Configuration["Certificate"];
          var pfxBytes = Convert.FromBase64String(clientSecret);
          var certificate = new X509Certificate2(pfxBytes, "PasswordHere");
          return certificate;
      }
  </code></pre>
  
  <p>The certificate is generated by me using openssl:</p>
  
  <pre><code>openssl req –newkey rsa:2048 –nodes –keyout XXXXX.key –x509 –days 365 –out XXXXX.cer
  
  openssl pkcs12 –export –in XXXX.cer –inkey XXXX.key –out XXXX.pfx
  </code></pre>
  
  <p>Then I get the certificate by using:</p>
  
  <pre><code>$pfxFilePath = 'C:\XXXX.pfx'
  $pwd = 'PasswordHere'
  $flag = [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::Exportable
  $collection = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2Collection
  $collection.Import($pfxFilePath, $pwd, $flag)
  $pkcs12ContentType = [System.Security.Cryptography.X509Certificates.X509ContentType]::Pkcs12
  $clearBytes = $collection.Export($pkcs12ContentType)
  $fileContentEncoded = [System.Convert]::ToBase64String($clearBytes)
  </code></pre>
  
  <p>I grab the <code>$fileContentEncoded</code> value and paste it into <code>appsettings.json</code>.</p>
  
  <p>When i debug it, the result is: <code>error:23076071:PKCS12 routines:PKCS12_parse:mac verify failure</code> when i'm trying to create <code>X509Certificate2</code> object using the method above.</p>