My web application receives encrypted data from another server encrypted with RSA keys. Where should I store the private key (RSA) in a .NET web application (Windows)? It seems that putting in it in the application data folder (app_data) probably isn't ideal. Is there a 'best practice' for this?
I wasn't sure if it's possible to convert the public/private key pair into another format and perhaps store it in the certificate store, but I'm not sure an RSA public/private key pair is even a "certificate".
If this was a PCI compliance issue, it seems I would not even be allowed to store them on the same server, but I cannot then see how one could implement decryption on the server?