{"record":{"id":"633d40e7ad3468f3","repo":"dotnet/maui","slug":"failed-to-install-signing-cert-into-localmachine-t","errorCode":null,"errorMessage":"Failed to install signing cert into LocalMachine\\TrustedPeople. This step requires an elevated (administrator) shell on first run. After the cert is created once, subsequent runs can be performed without elevation.","messagePattern":"Failed to install signing cert into LocalMachine\\\\TrustedPeople\\. This step requires an elevated \\(administrator\\) shell on first run\\. After the cert is created once, subsequent runs can be performed without elevation\\.","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"eng/devices/windows.cake","lineNumber":161,"sourceCode":"\t\t// current non-elevated user can use it to sign. LocalMachine\\TrustedPeople only needs the\n\t\t// cert's public key for sideload trust validation, so a user-scope private key is enough.\n\t\t// Using MachineKeySet here would put the key in C:\\ProgramData\\Microsoft\\Crypto\\...\n\t\t// which is unreadable from a non-admin process — signtool then fails with \"No certificates\n\t\t// were found that met all the given criteria\" even though the cert is visible in the store.\n\t\tvar tmpCert = new X509Certificate2(cert.Export(X509ContentType.Pfx), \"\", X509KeyStorageFlags.UserKeySet | X509KeyStorageFlags.PersistKeySet);\n\t\tcertificateThumbprint = tmpCert.Thumbprint;\n\n\t\t// Writing to LocalMachine\\TrustedPeople requires admin. If we don't have it, fail with a\n\t\t// clear message rather than the raw \"Access is denied\" from the store.\n\t\ttry\n\t\t{\n\t\t\tlocalTrustedPeopleStore.Open(OpenFlags.ReadWrite);\n\t\t\tlocalTrustedPeopleStore.Add(tmpCert);\n\t\t\tlocalTrustedPeopleStore.Close();\n\t\t}\n\t\tcatch (System.Security.Cryptography.CryptographicException ex)\n\t\t{\n\t\t\tthrow new Exception(\n\t\t\t\t\"Failed to install signing cert into LocalMachine\\\\TrustedPeople. \" +\n\t\t\t\t\"This step requires an elevated (administrator) shell on first run. \" +\n\t\t\t\t\"After the cert is created once, subsequent runs can be performed without elevation.\",\n\t\t\t\tex);\n\t\t}\n\n\t\t// CurrentUser\\My only needs admin if the process doesn't own the profile, so do it after\n\t\t// the LocalMachine write succeeded.\n\t\tvar currentUserMyStore = new X509Store(\"My\", StoreLocation.CurrentUser);\n\t\tcurrentUserMyStore.Open(OpenFlags.ReadWrite);\n\t\tcurrentUserMyStore.Add(tmpCert);\n\t\tcurrentUserMyStore.Close();\n\t}\n\telse\n\t{\n\t\tInformation(\"Reusing existing cert {0} from CurrentUser\\\\My.\", certificateThumbprint);\n\t}\n","sourceCodeStart":143,"sourceCodeEnd":179,"githubUrl":"https://github.com/dotnet/maui/blob/f377ff1c5ee04d334d8a925f50c83a6b7afddf03/eng/devices/windows.cake#L143-L179","documentation":"Thrown in GenerateMsixCert during first-time cert creation: after generating a self-signed cert and re-importing it with UserKeySet, opening LocalMachine\\TrustedPeople for ReadWrite and calling Add throws CryptographicException because writing to the LocalMachine store requires administrator privileges. The message explains this is a one-time elevation requirement.","triggerScenarios":"First run of the packaged test target on a non-elevated shell (no usable cert exists yet, so the creation path is taken); the cert was deleted and must be recreated; running on a fresh user profile or machine.","commonSituations":"New developer machine; CI runner without an admin-provisioned cert; LocalMachine\\TrustedPeople cleared by policy; switching commonName so no existing cert matches.","solutions":["Run the GenerateMsixCert task once from an elevated (administrator) terminal; the cert is then installed and later non-elevated runs reuse it (the IsCurrentUserSigningCertUsable branch).","If you cannot get admin, ask an admin to run the task once, or pre-install the cert in LocalMachine\\TrustedPeople out-of-band.","Confirm the elevated run completed by checking 'Cert thumbprint:' prints a non-null value before building the MSIX.","Avoid re-deleting the cert after first creation so you do not re-trigger the elevation requirement."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Detect first-run (no usable cert) and require elevation up front\nvar needsAdmin = string.IsNullOrEmpty(certificateThumbprint);\nif (needsAdmin && !IsElevated())\n    throw new Exception(\"First-run cert creation requires an elevated shell. Re-run as administrator.\");","typeGuard":null,"tryCatchPattern":"catch (System.Security.Cryptography.CryptographicException ex)\n{\n    throw new Exception(\"LocalMachine\\\\TrustedPeople write needs admin. Re-run elevated once; later runs are non-elevated.\", ex);\n}","preventionTips":["Run the packaged-test cert task elevated once on each new machine/profile.","Do not delete the cert after creation; reuse avoids re-elevation.","Provision the cert via an admin step in CI images so test jobs stay non-elevated."],"tags":["cake","windows","certificate","msix","elevation","first-run"],"backgroundTag":null,"analyzedSha":"f377ff1c5ee04d334d8a925f50c83a6b7afddf03","analyzedAt":"2026-08-13T14:26:18.069Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}