Incorrectly registered cryptopro key set. Error: Invalid registered keyset (0x80070643). Installing manager certificates

The message does not conform to XML Encryption format.
Contact the developer of the software that encrypted the data.
Provide the following information: Missing EncryptedData class element ru.ibs.cryptopro.jcp.crypt.CryptoException

Causes:

Incorrect settings of the AWP of the medical facility in terms of signing;

Incorrect encryption provider settings;

CryptoPro CSP certificate, private key or license expires.

What to do:

1. Configure AWP LPU

Attention! Support for the GOST 2012 algorithm in the automated workplace of the medical facility was added in version 2.0.21. If you have an earlier version, please update it to the current one.
In the Administration - Configuring Signatures for Services menu, set the "Encrypt message" flag. After that, you need to specify the Name of the FSS certificate and the Type of container. This certificate can be downloaded from the website https://lk.fss.ru/eln.html (if you configure services for testing, then you need to download the FSS TEST certificate). After downloading, install it on your computer.
Please note that MO Certificates (must have a private key) and FSS must be installed in the "Personal" storage, respectively, the container type is "Personal". The entire chain of upstream certificates to the "Trusted Root Certification Authorities" folder. All certificates must be current and not revoked.

2. Check the encryption provider settings

When using a cryptographic provider Vipnet CSP the working version is 4.4.
When using a cryptographic provider CryptoPro CSP the working version is 4.0 and higher. Build 4.0.9963 is recommended.
Through the "Control Panel" in CryptoPro CSP, go to the "Service" tab, click the "Delete remembered passwords ..." button. In the "Delete remembered passwords" window, select "Delete all remembered passwords of private keys: User".
If signing certificates according to GOST 2012 are used, check the settings on the Algorithms tab. In the drop-down list "Select CSP type" select GOST R 34.10-2012. The following parameters must be set:

Below is a sample of settings in CryptoPro CSP 5.0

If you cannot change the parameters on the "Algorithms" tab (even by running CryptoPro CSP on behalf of the administrator), you must do the following:
Open the HKEY_LOCAL_MACHINE \ SOFTWARE \ WOW6432Node \ Crypto Pro \ Cryptography \ CurrentVersion \ Parameters key in the Windows registry and change the EnableOIDModify value to 1. Then you need to reboot.

After changing the settings of the encryption provider, it is necessary to restart the AWP of the LPU.

3. Check certificates and licenses

Using the system utility certmgr.msc (Start - Run (Find programs and files)) open your certificate. The certificate must not expire.
Launch CryptoPro CSP. On the "General" tab, check the validity period of the encryption provider license.
Open the "Tools" tab and click the "Test" button. Select the container for the private key of your certificate. In the testing window that opens, there should be no errors, no messages about the expiration of the key, etc.

2. ORA-20015: Unable to determine ELN status:

To switch to the "Extended" status, you must add a period of incapacity for work;
To switch to the "Closed" status, you must fill in the fields: "Start work on: date" or "Other: code";
To switch to the status "Referral to ITU", you must fill in the field "Date of referral to the ITU Bureau"

Cause:

1. There is an ELN in the system with the same number and the same data that you send (data duplication);

2. The data sent to ELN does not correspond to the stage of registration (filling) of ELN:

• insufficient data to determine the state of ELN;
• the entered data refer to different stages of registration (filling) ELN.

What to do:

3. ORA-20013: Failed to update data. The record being updated has lost its relevance

Cause:

You are trying to change an ELN that was previously changed by someone.

What to do:

1. Request the current state of the ELN from the system, thereby excluding the repeated sending of the same data;

2. Perform the necessary further operation with the ELN in accordance with the order 624n:

• extension (add a new period of incapacity for work);
• closing (add information about closing);
• referral to ITU (add referral information to ITU).

4. ORA-20001: Access to ELN with No. _________, SNILS _________, status _________ - limited

Cause:

You are trying to get the data of an ELN, which is in a status that restricts your access. For example, a policyholder is trying to obtain data from an ELN that has not yet been closed by a medical organization. According to the process model, the policyholder can receive ELN data for editing only on status 030 - Closed. Another example - the ITU bureau cannot receive ELN data that is not sent to the ITU bureau (status 040 - Referral to ITU)

What to do:

1. Make sure that the ELN number, the data of which you want to receive, is entered correctly.

2. Wait for the ELN transition to the status, which will allow you to receive the ELN data.

5. Failed to call the data transfer / receive service. Failed to decrypt message.

Perhaps the message was encrypted on a key different from the key of the authorized person of the FSS.

Check the correctness and relevance of the key of the authorized person of the FSS.

Causes:

In the settings for signing and encryption in the software used by the user, an incorrect certificate is specified in the field "Certificate of an authorized person of the FSS";

A cryptographic provider Vipnet CSP of a certain assembly is used.

What to do:

Indicate the correct certificate of the authorized person of the FSS:

• Determine the direction of sending requests - test or productive;
• Download the certificate of an authorized person of the FSS in the ELN section on the Foundation's website;
  The certificate for test sending is published on the website https://lk-test.fss.ru/cert.html
  The certificate for the product is published on the website https://lk.fss.ru/cert.html;
• Close the software you are using. Delete the installed FSS certificates from the "Personal" store using the certmgr.msc system utility (Start - Run (Find programs and files)). Install the downloaded certificate on the computer in the "Personal" store for the current user;
• Specify this certificate in the corresponding settings of the software used.

When using the Vipnet CSP encryption provider, the working version is 4.4.

6. Failed to call the data transfer / receive service.

Message encryption error for recipient. Client received SOAP Fault from server: Fault occurred while processing. Please see the log to find more detail regarding exact cause of the failure.null

Cause:

You entered an invalid certificate for encrypting the message in the MO Certificate Name field: the specified certificate can only be used for signing, not encryption.

What to do:

Order and install a certificate that supports not only the signing operation, but also the encryption operation.

7. Error installing AWP LPU: Unable to build entity manager factory.

An error occurred while trying to load data from the database. Provide the administrator with the following information:

Unable to build entity manager factory.

Cause:

• The application was installed incorrectly (the database was installed incorrectly);
• The application database is installed but not available.

What to do:

1. Run the installation with administrator rights;

2. Complete the installation of the program step by step (the path where the instruction is located: http://lk.fss.ru/eln.html).

If the application was installed in accordance with the instructions, but the error persists, you need to check:

• The postgresql-9.5 service is disabled on the computer. Right-click on the "My Computer" icon - Management - Services and Applications - Services, postgresql-9.5 should be started, it should start automatically. To configure the startup and operation of the Windows service, contact your system administrator;
• Incorrect password for fss user specified in database connection settings. Check that this password has not been changed in the database, the default password is fss;
• Check the PostgreSQL database installation directory, by default - C: \ postgresql \;
• Connection to the PostgreSQL database is carried out by default on port 5432. This port must be open and accessible. To check, contact your system administrator;
• The application on the client machine cannot communicate with the server. any network restriction is set. Check the settings of antiviruses, firewalls, and other network software; the client machine must have permission to connect to the server on port 5432.

8. An error occurred while trying to load data from the database.

An error occurred while trying to load data from the database.

Please provide the following information: org.hibernate.exception.SQLGrammarException: could not extract ResultSet.

Cause:

APM LPU application cannot get data from PostgreSQL database. This error occurs most often after installing an update, when the application is updated and the PostgreSQL database has not been updated for some reason.

What to do:

• If the application is installed on the user's computer, and the PostgreSQL database is on the server. It is necessary to start updating the application not only on the client, but also on the server machine;
• If both the application and the PostgreSQL database are installed on the same machine. Check the application installation directory. By default, the APM LPU application is placed in the C: \ FssTools directory, and the PostgreSQL database in the C: \ postgresql directory. If during the initial installation a different directory was selected for installing the application, then during the update you must specify this particular directory.

9. An error occurred when trying to enter the signature settings in the workstation software.

When trying to enter the signature settings in the workstation software, the error "Internal error. Reason: java.lang.ExceptionInInitializerError" or

"Internal Error. Reason: java.lang.NoClassDefFoundError: Could not initialize class ru.ibs.fss.common.security.signature.COMCryptoAPIClient"

Cause:

The application was not installed correctly (the GostCryptography.dll library was not registered).

What to do:

1. Make sure that the bitness of the OS matches the bitness of the application installer.

2. Check if the components Microsoft.Net Framework version 4 and higher are installed on the system (by default, these components are installed in C: \ Windows \ Microsoft.NET \ Framework). These components can be downloaded from microsoft.com.

3. Check that the folder where the application is installed contains the GostCryptography.dll file (by default, this file is installed in C: \ FssTools). If this file is not present, try reinstalling the application.

4. If everything is correct, run on the command line:

Cd C: \ FssTools - go to the folder where the GostCryptography.dll file is located

C: \ Windows \ Microsoft.NET \ Framework \ v4.0.30319 \ RegAsm.exe / registered GostCryptography.dll - with your installation address for Microsoft.NET components

5. Restart the application.

10. Error calling the data transfer / receive service. Invalid element in ru.ibs.fss.eln.ws.FileOperationsLn_wsdl.ROW - SERV1_DT1.

Error: "Error calling data transfer / receive service. Invalid element in ru.ibs.fss.eln.ws.FileOperationsLn_wsdl.ROW - SERV1_DT1"

Cause:

The "SERV1_DT1" field has been removed in the new specification 1.1 (version 14 and higher AWP LPU), the connection string has been changed.

What to do:

Change the connection string in the settings.

In the Administration - FSS service settings - Connection string, specify the following service address:

• For work https://docs.fss.ru/WSLnCryptoV11/FileOperationsLnPort?WSDL
• For testing:

13. AWP for preparing calculations for the FSS, error "The set of keys is not defined"

Cause:

GOST of the FSS certificate does not match the encryption provider selected in the settings, or the encryption provider cannot receive the private key from the private key container for the selected certificate.

What to do:

• In the settings of the AWS Signing and encryption, check that the specified encryption provider matches the one actually installed by the user;


• In the settings of the AWS Signing and encryption, check that the GOSTs of the signing certificate and the FSS certificate are the same and correspond to the selected encryption provider;


• If you are using an ES certificate in accordance with GOST 2012, open the certificate, the "Contents" tab, the "Electronic Signature Tool" parameter.
  It is necessary to check that the ES tool corresponds to the encryption provider installed by the user;


• If you use an ES certificate in accordance with GOST 2012 and a CryptoPro crypto provider, check the settings on the Algorithms tab. Select GOST R 34.10-2012 (256) in the drop-down list "Select CSP type". The following parameters must be set:

  "Parameters of the encryption algorithm" - GOST 28147-89, parameters of the encryption algorithm TK26 Z

  "Signature algorithm parameters" - GOST 34.10-2001, default parameters

  "Parameters of the Diffie-Hellman algorithm" - GOST 34.10-2001, default exchange parameters



• The private key is missing from the certificate. Using the system utility certmgr.msc, open the certificate, on the "General" tab it should be written "There is a private key for this certificate";


• The crypto provider does not see the private key container for this certificate. In the CryptoPro CSP encryption provider, go to the "Service" tab and click "Delete remembered passwords" - for the user;


• The container may be damaged by third-party software. Reinstall the certificate again, with the obligatory indication of the container;


• Reinstall the crypto provider.

Good afternoon dear friends! Today we will consider the problem with the AWS FSS program, namely "Error: keyset not defined." You will most likely encounter this error when loading ELN. Let's celebrate! Go!

AWP FSS error: keyset not defined

If you cannot solve this problem on your own, then you can go to the section and our specialists will help you.

I ran into this problem just when loading an electronic sick leave. Let's update first. Read how to update the AWS FSS here.

Now let's go to the "Accounting work" section of the menu and select "AWS for signing and encryption".

Now let's be careful! We need to put down the correct keys. That is, choose the right one for our certificates.

What certificates to put when uploading a sick leave to the FSS AWS

Go to the section “Personal ELN certificate. Insured ". This is a certificate of our organization! We select it by clicking on the button with an open folder.



Go to the personal section and select our certificate.



STOP! Not a single certificate? This is already strange!

Certificates are not displayed in AWS FSS, what should I do?

Since 2019, we are switching to the new GOST by electronic signature. It is called GOST 2012. Until 2019, we used certificates issued under GOST 2001. It turns out that 2019 is a transitional year between the two GOSTs. Now it is allowed to use the certificate of both GOST 2001 and 2012. If you reissued or issued a new certificate in 2019, then with a probability of 99% you already have a new GOST 2012. If you issued a certificate in 2018, then most likely 2001. This is the whole problem ... Now we will find our certificates!

Please note that the new versions have a switch for different GOSTs.



By switching this mode, you will see your certificates. Try to put GOST 2001 first, if the certificates are not displayed, put GOST 2012. I am sure you will find your certificate.

That's it, we found our hidden certificate, now let's move on!

Installing manager certificates

Personal certificate ELN. Supervisor. You exhibit a director's certificate, as a rule, it coincides with the organization's certificate.

Installing the correct encryption provider

Now we need to decide on. It sounds scary and difficult, but now everything will be clear!

We rise higher and see which GOST certificate we chose. If you have a GOST 2001 certificate, then in the "Cryptographic Provider" line, select "Crypto-Pro GOST R 34.10-2001 Cryptographic Service Provider". If your certificate is 2012 GOST, then choose "Crypto-Pro GOST R 34.10-2012 Cryptographic Service Provider".



Everything is very simple here. Firstly, I already have an article on this topic, everything is described in detail there, so I will not write again. You can read it here.

I'll just say that for a successful installation you need to press 2 buttons: "Install the certificate of the authorized person of the FSS ELN" and "Install the certificate of the authorized person of the FSS".





RESOLVED!

Friends! If suddenly your error persists, experiment with certificates and GOSTs, with the line Crypto Provider. The whole mistake lies in this!If you still can't set it up on your own, then go to the "" section, and I will help you!

If you need the help of a professional system administrator to resolve this or any other issue, go to the section, and our employees will help you.

That's all! Now you know what to do if you have an error in the programAWP FSS error: keyset not defined.

If you have any questions, ask them in the comments! Good luck and good to everyone!

To be the very first to receive all the news from our site!

Creation of an electronic signature on the 1C platform using CryptoPro CSP can be performed both on the server side and on the client side. In both cases, a rather annoying error can appear:
Invalid keyset parameter.

This error is unpleasant in that it has many reasons, and in order to fix it, you need to carry out a whole range of measures.

Formulation of the problem

Let's say there is an information base with which the 1C platform works in a client-server version. We will create an electronic signature on the server side; in this case, it is recommended to use certificates and keys located in the storage of the local computer, since they will be available to any Windows user. And also there is an installed certificate in the storage of the local computer in the Personal section (see Figure 1) with a binding to the private key (see Figure 2).
When creating a digital signature, an exceptional error occurs, indicating an incorrect parameter of a set of keys.

Solution

The creation of an ES on the server side means that this operation will be performed on behalf of the 1C server user (USR1CV82 or USR1CV83, depending on the platform version). One of the reasons for the incorrect keyset parameter error is that the user does not have access to the private (secret) key of the certificate.

To give the user the necessary rights to work with the certificate's private key, open the snap-in Certificates(connected automatically when CryptoPro CSP is installed) and find the certificate that is used to create the digital signature. Right-click on it and select All Tasks -> Manage Private Keys(see figure 3).
In the window that opens, add a user and set full access to the private key.
The error should be gone.

Thank you very much, Mikhail, we did everything promptly and the main thing is clear to me ... Since we have found a common language. I would like to continue the communication with you in the future. I look forward to fruitful cooperation.

Olesya Mikhailovna - General Director LLC "VKS"

On behalf of the State Unitary Enterprise "Sevastopol Aviation Enterprise" we express our gratitude for the professionalism and efficiency of your company! We wish your company continued prosperity!

Guskova Lilia Ivanovna - manager. SUE "SAP"

Thank you, Mikhail, very much for your help with the design. Very qualified employee +5!

Nadia Shamilevna - entrepreneur IP Anoshkina

On behalf of the company "AKB-Auto" and on my own behalf, I express my gratitude to you and all employees of your company for the productive and high-quality work, sensitive attitude to the client's requirements and efficiency in the execution of the ordered work.

Nasibullina Alfira - Senior Manager"AKB-Auto"

I would like to thank the consultant Mikhail for the excellent work, timely and complete consultations. He is very attentive to the client's problems and questions, prompt solution of the most difficult situations, it would seem to me. It's a pleasure to work with Mikhail !!! Now I will recommend your company to my clients and friends. And the technical support consultants are also very polite, attentive, helped to cope with the complex installation of the key. Thank you!!!

Olga Sevostyanova.

Acquiring a key turned out to be very easy and even enjoyable. Many thanks for the assistance to manager Mikhail. Explains complex and massive things to understand, succinctly, but very clearly. In addition, I called the free hotline and online, together with Mikhail I left a request. I got a key made in 2 working days. In general, I recommend it if you save your time, but at the same time want to have an understanding of what you buy and what you pay for. Thank you.

Levitsky Alexander Konstantinovich Samara

Personal gratitude to the consultant Mikhail Vladimirovich for prompt advice and work on the accelerated receipt of the ES certificate. During the preliminary consultation, the optimal set of individual services is selected. The end result is immediate.

Stoyanova N.L. - Chief Accountant LLC "SITEKRIM"

Thank you for your prompt work and competent help! I was very pleased with the consultation!

Dmitry Fomin

Expert Sistema LLC would like to thank the consultant Mikhail for the prompt work! We wish your company growth and prosperity!

Sukhanova M.S. - AppraiserLLC "Expert System", Volgograd

Thanks to the consultant who introduced himself as Mikhail for his prompt work with clients.

Stepan Gennadievich Ponomarev

Many thanks to the consultant Mikhail for his assistance in obtaining an EDS. For prompt work and advice on issues arising in the process of registration.

Leonid Nekrasov

The company, represented by its consultant Mikhail, does the impossible! Acceleration of accreditation in less than 1 hour! Payment upon delivery of the service. I thought it couldn't happen. With full responsibility, I can advise you to contact the Center for issuing electronic signatures.

Good afternoon friends!

Last week, a visitor contacted us with a strange problem. The user says: when trying to install any application in Windows 8.1,preinstalled on a laptop, he has an error occurred - n invalid registered keyset. Moreover, he tried to install the most common programs, for example iTunes, various games such as The Sims, Need For Speed, and so on. In most cases, at the time of installation, an error occurred incorrect registered keyset and distribution, (installer) finished its work. Sometimes an error crashed0x80070643, instead of that, for example, when installing the Microsoft Visual C ++ component.

When I tried to google information on the Internet, I could not solve the problem. Most of the links lead to forums where problems related to crypto-applications such as crypto-pro are discussed. But this is not the point, no programs were used.

Incorrect registered keyset, error code 0x80070643. What did you find?

• Some forums refer to a problem with Windows Defender - tried to disable it, it doesn't help.
• A possible cause of the error is Avast antivirus. The user's antivirus was installed, removed completely, just in case, we went through the utility to completely remove the antivirus (avastclear.exe)
• The Microsoft .NET Framework was completely reinstalled by disabling it as a Windows component.
• Tried cleaning the leftovers from the utilities:

.Net framework cleanup tool
.Net framework repair tool

But unfortunately the effect did not happen either.

• Naturally, we tried to install all the latest updates on Windows 8.1.
• Checked completely with antivirus.

Solution:

1. It is necessary to delete the directory (folder) located in the following path C: \ Users \ YOUR USER \ AppData \ Roaming \ Microsoft \ Crypto \ RSA (meaning the RSA folder itself). After uninstallation - restart the computer, after restart, Windows must recreate this folder again. (the appdata folder can be hidden and you need to go to it by copying the entire path, or by checking the box to display hidden files in the explorer settings).
2. You can try to create a new Windows 8 user and check if the installation works under the new user (the user must be in the Administrators group).

We really hope that this article will help many people to solve the problem (Invalid registered keyset, 0x80070643) with Windows 8.1 without reinstalling. If you still have questions, please ask them in the comments.