New certificate fails to load after creation 'The specified network password is not correct'

[mregen]

Type of Issue
-[X] Bug

Describe the Issue

Running a .NET Core 3 UA application in docker windows container sometimes fails to start when a new application certificate is created with error: 'The specified network password is not correct'. The container starts ok using the same previously created certificate when restarted.

To Reproduce
Steps to reproduce the behavior:

1. Run a OPC app in docker windows container
2. Start application
3. infrequently the application fails to start

Expected behavior
New cert can be loaded.

Screenshots
If applicable, add screenshots to help explain your problem.

**Log output**
[14:03:22 INF] No existing Application certificate found. Create a self-signed Application certificate valid from yesterday for 12 months,
 32 [14:03:22 INF] with a 2048 bit key and 256 bit hash.
 33 [14:03:25 ERR] Could not load private key certificate from file: OpcPublisher [EC0838A4BF488F44A52B3F5AFFDA0EB62DD21AFD].pfx
 34  WindowsCryptographicException 'The specified network password is not correct.'
 35 
 36 
 37 ========================================
 38 Id: Bad
 39 Description: [WindowsCryptographicException] The specified network password is not correct.
 40 >>> The specified network password is not correct.
 41 ---    at Internal.Cryptography.Pal.CertificatePal.FilterPFXStore(Byte[] rawData, SafePasswordHandle password, PfxCertStoreFlags pfxCertStoreFlags)
 42 ---    at Internal.Cryptography.Pal.CertificatePal.FromBlobOrFile(Byte[] rawData, String fileName, SafePasswordHandle password, X509KeyStorageFlags keyStorageFlags)
 43 ---    at System.Security.Cryptography.X509Certificates.X509Certificate..ctor(String fileName, String password, X509KeyStorageFlags keyStorageFlags)
 44 ---    at Opc.Ua.DirectoryCertificateStore.Load(String thumbprint)
 45 ========================================
 46 
 47 Internal.Cryptography.CryptoThrowHelper+WindowsCryptographicException: The specified network password is not correct.
 48    at Internal.Cryptography.Pal.CertificatePal.FilterPFXStore(Byte[] rawData, SafePasswordHandle password, PfxCertStoreFlags pfxCertStoreFlags)
 49    at Internal.Cryptography.Pal.CertificatePal.FromBlobOrFile(Byte[] rawData, String fileName, SafePasswordHandle password, X509KeyStorageFlags keyStorageFlags)
 50    at System.Security.Cryptography.X509Certificates.X509Certificate..ctor(String fileName, String password, X509KeyStorageFlags keyStorageFlags)
 51    at Opc.Ua.DirectoryCertificateStore.Load(String thumbprint)
 52 [14:03:25 WRN] OPC: ***EXCEPTION*** BadConfigurationError 'There is no cert with subject OpcPublisher in the configuration.
 53  Please generate a cert for your application,
 54  then copy the new cert to this location:
 55  pki\own
 56 '
 57 [14:03:25 FTL]    at Opc.Ua.Configuration.ApplicationInstance.CheckApplicationInstanceCertificate(Boolean silent, UInt16 minimumKeySize, UInt16 lifeTimeInMonths)
 58    at OpcPublisher.OpcApplicationConfiguration.ConfigureAsync() in D:\a\1\s\modules\src\Microsoft.Azure.IIoT.Modules.OpcUa.Publisher\src\OpcApplicationConfiguration.cs:line 180
 59    at OpcPublisher.Program.MainAsync(String[] args) in D:\a\1\s\modules\src\Microsoft.Azure.IIoT.Modules.OpcUa.Publisher\src\Program.cs:line 698
 60 Opc.Ua.ServiceResultException: There is no cert with subject OpcPublisher in the configuration.
 61  Please generate a cert for your application,
 62  then copy the new cert to this location:
 63  pki\own
 64 
 65    at Opc.Ua.Configuration.ApplicationInstance.CheckApplicationInstanceCertificate(Boolean silent, UInt16 minimumKeySize, UInt16 lifeTimeInMonths)
 66    at OpcPublisher.OpcApplicationConfiguration.ConfigureAsync() in D:\a\1\s\modules\src\Microsoft.Azure.IIoT.Modules.OpcUa.Publisher\src\OpcApplicationConfiguration.cs:line 180
 67    at OpcPublisher.Program.MainAsync(String[] args) in D:\a\1\s\modules\src\Microsoft.Azure.IIoT.Modules.OpcUa.Publisher\src\Program.cs:line 698
 68 [14:03:25 FTL] Publisher exiting... 

Code snippets

Environment (please complete the following information):

• OS: Windows 10 / Docker with Windows container
• Development environment: Visual Studio 2022
• Runtime: .NET Core 3.1
• OPC Package Release Version:1.4.367.75
• Component: Opc.Ua.Configuration
• Server:

[mregen]

see also @ZbynekZ
https://kb.opclabs.com/Error_%22The_specified_network_password_is_not_correct.%22

Not sure if the issue has the same root cause and if it gets improved by this workaround. Maybe permission also affect the timing. But in the windows container the MachineKeySet is not accessible.