Dim strContent As String = oMsg.BodyPart.GetStream.ReadText
    Dim str_err As String = ""
    Dim signedbytes As Byte()

    ' first look in LocalMachine store
    AddLog(Now.ToString & Chr(9) & strL_SendMail_Sign_Cert_LocalMashine_Looking) ' "Looking for certificate in LocalMashine store."
    Dim certificate As X509Certificate2 = _
     GetCertForSignature(New MailAddress(oMsg.From).Address, StoreLocation.LocalMachine)
    If certificate IsNot Nothing Then
      AddLog(Now.ToString & Chr(9) & strL_SendMail_Sign_Cert_LocalMashine_Found) ' "Valid certificate found in LocalMashine store."
      AddLog(Now.ToString & Chr(9) & strL_SendMail_Sign_SigningMailContent) ' "Signing mail content."
      signedbytes = SignContent(strContent, certificate, str_err)
      If signedbytes Is Nothing Then
        AddLog(Now.ToString & Chr(9) & str_err)

  Public Function SignContent(ByVal str_content As String, ByVal certificate As X509Certificate2, _
   Optional ByRef str_error As String = vbNullString) As Byte()
    Try
      Dim data As Byte() = Encoding.GetEncoding(1252).GetBytes(str_content)
      Dim content As New ContentInfo(data)
      Dim signedCms As New SignedCms(content, False)
      Dim signer As New CmsSigner(SubjectIdentifierType.IssuerAndSerialNumber, certificate)
      signedCms.ComputeSignature(signer, True) 'attached
      Return signedCms.Encode()
    Catch ex As Exception
      str_error = strL_SendMail_Sign_ErrorCode & ": " & Err.Number & " (" & Err.Description & ")" ' "Error code: "
      Return Nothing
    End Try
  End Function

20.07.2017 4:25:04	Signing mail with digital signature (opaque signing)
20.07.2017 4:25:04	Looking for certificate in LocalMashine store.
20.07.2017 4:25:04	Valid certificate found in LocalMashine store.
20.07.2017 4:25:04	Signing mail content.
20.07.2017 4:25:04	Error code: 5 (Набор ключей не существует)

  Public Function IsNetworkServiceHasReadAccessToCert(ByRef cert As X509Certificate2) As Boolean
    If cert Is Nothing Then Return False
    Try
      Dim rsa As RSACryptoServiceProvider = cert.PrivateKey
      If rsa Is Nothing Then Return False
      Dim cspParams As CspParameters = New CspParameters(rsa.CspKeyContainerInfo.ProviderType, rsa.CspKeyContainerInfo.ProviderName, rsa.CspKeyContainerInfo.KeyContainerName)
      With cspParams
        .Flags = CspProviderFlags.UseExistingKey Or CspProviderFlags.UseMachineKeyStore
        .CryptoKeySecurity = rsa.CspKeyContainerInfo.CryptoKeySecurity
      End With
      For Each Rule As AuthorizationRule In _
       cspParams.CryptoKeySecurity.GetAccessRules(True, True, GetType(System.Security.Principal.NTAccount))
        Try
          If Rule.IdentityReference.Translate(GetType(SecurityIdentifier)) = _
           New SecurityIdentifier(WellKnownSidType.NetworkServiceSid, Nothing) Then
            Dim accessRule As CryptoKeyAccessRule = DirectCast(Rule, CryptoKeyAccessRule)
            If ((accessRule.CryptoKeyRights And CryptoKeyRights.GenericRead) = CryptoKeyRights.GenericRead) And _
             (accessRule.AccessControlType = AccessControlType.Allow) Then
              Return True
            End If
          End If
        Catch
        End Try
      Next
    Catch
    End Try
    Return False
  End Function

  Public Function SetNetworkServicesReadAccessToCert(ByRef cert As X509Certificate2) As Boolean
    If cert Is Nothing Then Return False
    Try
      Dim rsa As RSACryptoServiceProvider = cert.PrivateKey
      If rsa Is Nothing Then Return False
      Dim cspParams As CspParameters = New CspParameters(rsa.CspKeyContainerInfo.ProviderType, rsa.CspKeyContainerInfo.ProviderName, rsa.CspKeyContainerInfo.KeyContainerName)
      With cspParams
        .Flags = CspProviderFlags.UseExistingKey Or CspProviderFlags.UseMachineKeyStore
        .CryptoKeySecurity = rsa.CspKeyContainerInfo.CryptoKeySecurity
      End With

      'set rule
      cspParams.CryptoKeySecurity.AddAccessRule _
       (New CryptoKeyAccessRule(New SecurityIdentifier(WellKnownSidType.NetworkServiceSid, Nothing), _
       CryptoKeyRights.GenericRead, AccessControlType.Allow))
      Using rsa2 As New RSACryptoServiceProvider(cspParams)
        'Only created to persist the rule change in the CryptoKeySecurity
      End Using
      'на всяк. случай проверим
      If IsNetworkServiceHasReadAccessToCert(cert) Then Return True
    Catch
    End Try
    Return False
  End Function

Dim rsa As RSACryptoServiceProvider = cert.PrivateKey

  Private Sub ButtonReinstallToLocal_Click(sender As Object, e As EventArgs) Handles ButtonReinstallToLocal.Click
    Dim certificate As X509Certificate2 = _
    GetCertForSignature("blabla@gmail.com", StoreLocation.CurrentUser)
    If certificate IsNot Nothing Then
      MsgBox("cert. found in current user")
      MsgBox(ReInstallCertToLocalMachine(certificate))
    Else
      MsgBox("cert. not found in current user")
    End If
  End Sub


  Public Function ReInstallCertToLocalMachine(ByRef cert As X509Certificate2) As Boolean
    Try
      Dim sb As Byte()
      sb = cert.Export(X509ContentType.Pkcs12, "12345")
      Dim newcert As X509Certificate2 = _
       New X509Certificate2(sb, "12345", X509KeyStorageFlags.Exportable Or X509KeyStorageFlags.MachineKeySet Or X509KeyStorageFlags.PersistKeySet)
      Dim store As X509Store = New X509Store(StoreLocation.LocalMachine)
      store.Open(OpenFlags.ReadWrite)
      store.Add(newcert)
      store.Close()
      Return True
    Catch
      Return False
    End Try
  End Function