Hi
Please i need help on this. Our CRM on-premise is down. Both internal and IFD. We continually get this error with 500 Internatl server error. I have reimported certificates, gone through all the steps on the ADFS server, CRM server and WAP and still get the same error. I have done everything suggested on forums wrt this error and nothing has helped. The relying party trusts for the CRM are in an error state all the time and will not update from Federation Metadata with "An error occurred during an attempt to read the federation metadata. Verify that the specified URL or host name is a valid federation metadata endpoint. Verify your proxy server setting. Error message: The remote server returned an error: (500) internal server error. " Same error over and over. Every time someone tries to access the CRM (including ADFS) the CRM server shows event ID 1309:
Event code: 3005
Event message: An unhandled exception has occurred.
Event time: 2022-11-10 03:34:52 PM
Event time (UTC): 2022-11-10 01:34:52 PM
Event ID: 9600e42c0eed458c805cd060a3205feb
Event sequence: 1092
Event occurrence: 154
Event detail code: 0
Application information:
Application domain: /LM/W3SVC/2/ROOT-1-133125463697610550
Trust level: Full
Application Virtual Path: /
Application Path: C:\Program Files\Microsoft Dynamics CRM\CRMWeb\
Machine name: CRM
Process information:
Process ID: 4256
Process name: w3wp.exe
Account name: HIDDEN
Exception information:
Exception type: CryptographicException
Exception message: Invalid provider type specified.
at System.Security.Cryptography.Utils.CreateProvHandle(CspParameters parameters, Boolean randomKeyContainer)
at System.Security.Cryptography.Utils.GetKeyPairHelper(CspAlgorithmType keyType, CspParameters parameters, Boolean randomKeyContainer, Int32 dwKeySize, SafeProvHandle& safeProvHandle, SafeKeyHandle& safeKeyHandle)
at System.Security.Cryptography.RSACryptoServiceProvider.GetKeyPair()
at System.Security.Cryptography.RSACryptoServiceProvider..ctor(Int32 dwKeySize, CspParameters parameters, Boolean useDefaultKeySize)
at System.Security.Cryptography.X509Certificates.X509Certificate2.get_PrivateKey()
at System.IdentityModel.Tokens.X509AsymmetricSecurityKey.get_PrivateKey()
at System.IdentityModel.Tokens.X509AsymmetricSecurityKey.DecryptKey(String algorithm, Byte[] keyData)
at System.IdentityModel.Selectors.SecurityTokenResolver.SimpleTokenResolver.TryResolveSecurityKeyCore(SecurityKeyIdentifierClause keyIdentifierClause, SecurityKey& key)
at System.IdentityModel.Tokens.EncryptedSecurityTokenHandler.ReadToken(XmlReader reader)
at System.IdentityModel.Tokens.SecurityTokenHandlerCollection.ReadToken(XmlReader reader)
at System.IdentityModel.Services.TokenReceiver.ReadToken(String tokenXml, XmlDictionaryReaderQuotas readerQuotas, FederationConfiguration federationConfiguration)
at System.IdentityModel.Services.WSFederationAuthenticationModule.SignInWithResponseMessage(HttpRequestBase request)
at System.IdentityModel.Services.WSFederationAuthenticationModule.OnAuthenticateRequest(Object sender, EventArgs args)
at Microsoft.Crm.Authentication.Claims.CrmFederatedAuthenticationModule.OnAuthenticateRequest(Object sender, EventArgs args)
at System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
at System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep step)
at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)
Request information:
Request URL: internalcrm.xxxxxxx:443/default.aspx
Request path: /default.aspx
User host address: xx.xx.xx.xx
User:
Is authenticated: False
Authentication Type:
Thread account name: \HIDDEN
Thread information:
Thread ID: 26
Thread account name: \HIDDEN
Is impersonating: False
Stack trace: at System.Security.Cryptography.Utils.CreateProvHandle(CspParameters parameters, Boolean randomKeyContainer)
at System.Security.Cryptography.Utils.GetKeyPairHelper(CspAlgorithmType keyType, CspParameters parameters, Boolean randomKeyContainer, Int32 dwKeySize, SafeProvHandle& safeProvHandle, SafeKeyHandle& safeKeyHandle)
at System.Security.Cryptography.RSACryptoServiceProvider.GetKeyPair()
at System.Security.Cryptography.RSACryptoServiceProvider..ctor(Int32 dwKeySize, CspParameters parameters, Boolean useDefaultKeySize)
at System.Security.Cryptography.X509Certificates.X509Certificate2.get_PrivateKey()
at System.IdentityModel.Tokens.X509AsymmetricSecurityKey.get_PrivateKey()
at System.IdentityModel.Tokens.X509AsymmetricSecurityKey.DecryptKey(String algorithm, Byte[] keyData)
at System.IdentityModel.Selectors.SecurityTokenResolver.SimpleTokenResolver.TryResolveSecurityKeyCore(SecurityKeyIdentifierClause keyIdentifierClause, SecurityKey& key)
at System.IdentityModel.Tokens.EncryptedSecurityTokenHandler.ReadToken(XmlReader reader)
at System.IdentityModel.Tokens.SecurityTokenHandlerCollection.ReadToken(XmlReader reader)
at System.IdentityModel.Services.TokenReceiver.ReadToken(String tokenXml, XmlDictionaryReaderQuotas readerQuotas, FederationConfiguration federationConfiguration)
at System.IdentityModel.Services.WSFederationAuthenticationModule.SignInWithResponseMessage(HttpRequestBase request)
at System.IdentityModel.Services.WSFederationAuthenticationModule.OnAuthenticateRequest(Object sender, EventArgs args)
at Microsoft.Crm.Authentication.Claims.CrmFederatedAuthenticationModule.OnAuthenticateRequest(Object sender, EventArgs args)
at System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
at System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep step)
at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)
With regard to the "Invalid provider type specified." if I look at the store with certutil i find that on the CRM server with Windows server 2012R2, the certificate shows the provider as "Microsoft Software Key storage provider" as opposed to "Microsoft RSA Cryptographic Provider" like on our ADFS server which runs on 2016 with the same wildcard certificate. Could this be the issue? If so, how do we resolve this?
CRM has been down for 3 days now.
Another question is about the certificate in the relying party trust - is this supposed to be the same wildcard certificate used for the ADFS Server and CRM server or should it be another type of certificate?
I really look forward to your response and thank you in advance for your assistance.
Please let me know if I should be posting this elsewhere for help.