MSB3321 diagnostic code

This article describes the MSB3321 error code.

Message text

MSB3321: Importing key file 'value' was canceled.

Description

This error occurs when MSBuild tries to sign a ClickOnce assembly manifest with an Authenticode certificate, but fails to import the private key from the given key file.

During the ClickOnce deployment process, or when running the Publish target in MSBuild, an assembly is signed with a strong name Authenticode certificate, either a temporary "devtest" certificate, which you typically use during development, or a trusted certificate issued by a Certificate Authority (CA). The scenario is described at Build a ClickOnce application from the command line.

In order to use a certificate with a private key in a .pfx file, it needs to be verified with a password so the certificate is trusted; it can then be used by MSBuild. When you build and sign a manifest with Visual Studio, you provide the password in Visual Studio when you specify the key filename. However, when you build the same project on another machine, such as a build server, without installing or using Visual Studio, the key must be added to the build server's store of trusted certificates, and verified with the password. After that, it's available to MSBuild to sign a ClickOnce assembly.

Resolution

If you are building on a machine without Visual Studio installed, such as when setting up a build server, add the Authenticode certificate and private key to the Windows Trusted Publishers Certificate Store. You can use certmgr to add a certificate to the system store. Once added, it is available to MSBuild when trying to sign an assembly until the certificate expires or is removed.

You can also use dotnet-mage.exe for .NET projects, or mage.exe (Manifest Assembly Generation) for .NET Framework projects to generate and sign ClickOnce manifests. See Manually deploy a ClickOnce application.

Applies to

All versions of MSBuild