Exception when doing authentication with x509certificate

[nepgya2803]

I have to host my code on AWS, so I follow the guide to make my app into service. Here is what I come up with. I need help to figure out which part I am doing wrong

private async Task<PnPContext> ContextGenerator(string clientId, string tenantId, string siteUrl)
    {
        try
        {
            var host = Host.CreateDefaultBuilder().ConfigureServices((context, services) =>
                                {
                                    // Add PnP Core SDK
                                    services.AddPnPCore(options =>
                                    {
                                        options.PnPContext.GraphFirst = true;
                                        options.HttpRequests.UserAgent = "ISV|Contoso|ProductX";

                                        options.Sites.Add("Default", new PnPCoreSiteOptions
                                        {
                                            SiteUrl = siteUrl
                                        });
                                    });
                                    services.AddPnPCoreAuthentication(
                                        options =>
                                        {
                                            // Configure an Authentication Provider relying on the interactive authentication
                                            options.Credentials.Configurations.Add("CertAuth", new PnPCoreAuthenticationCredentialConfigurationOptions
                                            {
                                                ClientId = clientId,
                                                TenantId = tenantId,
                                                X509Certificate = new PnPCoreAuthenticationX509CertificateOptions
                                                {
                                                    Certificate = LoadCertificate("<my thumbprint string>"),
                                                }
                                            });


                                            // Configure the default authentication provider
                                            options.Credentials.DefaultConfiguration = "CertAuth";

                                            // Connect the configured authentication method to the configured site
                                            options.Sites.Add("Default", new PnPCoreAuthenticationSiteOptions
                                            {
                                                AuthenticationProviderName = "CertAuth",
                                            });

                                            options.Credentials.DefaultConfiguration = "CertAuth";

                                        }
                                    );
                                }).UseConsoleLifetime().Build();

            // Start the host
            await host.StartAsync();

            var scope = host.Services.CreateScope();

            // Ask an IPnPContextFactory from the host
            var pnpContextFactory = scope.ServiceProvider.GetRequiredService<IPnPContextFactory>();
            var pnpAuthenticationProviderFactory = scope.ServiceProvider.GetRequiredService<IAuthenticationProviderFactory>();
            var X509CertificateAuthProvider = pnpAuthenticationProviderFactory.Create("CertAuth");
            // Create a PnPContext
            var context = await pnpContextFactory.CreateAsync(new Uri(siteUrl));

            return context;
        }
        catch (Exception err)
        {
            Console.WriteLine(err.ToString());
            return null;
        }
    }

When the program reach this method pnpContextFactory.CreateAsync() method, I get the exception that

ID3035: The request was not valid or is malformed

[jansenbe]

@ngqtrieu99 : the .NET dependency injection parts should not be in the method that you use to request a PnPContext, adding the services to the dependency container should only happen once. I'm not familiar with .NET development on AWS, but for Azure Functions you would inject the services in program.cs and then use these services for your actual services (see https://pnp.github.io/pnpcore/demos/Demo.AzureFunction.OutOfProcess.AppOnly/readme.html and https://github.com/pnp/pnpcore/tree/dev/samples/Demo.AzureFunction.OutOfProcess.AppOnly for the code). You can also checkout our Polyglot notebook on application permissions: https://github.com/pnp/pnpcore/blob/dev/docs/polyglot/Getting%20started%20-%20application%20permissions.ipynb

[nepgya2803]

Thanks @jansenbe, it seems the problem is in the API permission, in my case, even after following the guide, the error is still there, all we need to do is add this permission

Sites.ReadWrite.All

[nepgya2803]

My bad @jansenbe , even after it generated the context and run well on my local, after I upload it to AWS, when it reach this part, it returned the "System.NullReferenceException: Object reference not set to an instance of an object" exception.

await context.Web.LoadAsync();

After checking the cloudwatch log, I found that this exception appeared before the LoadAsync() method

System.Security.Cryptography.CryptographicException: The specified X509 certificate store does not exist

I re-edited my code above. Could you check which part I did wrong?