Turns out there’s a setting in the IIS Application Pool configuration (Application Pools > Advanced Settings) to load the user profile for the application pool identity user. When set to false, the key containers aren’t accessible.
So just set Load User Profile option as True
