Re: CertEnumCertificatesInStore() and IE

From: Oliver Young (none)
Date: 12/09/03

  • Next message: Martijn Remmen: "Re: Implementing WlxDisplayStatusMessage" 
    Date: Tue, 9 Dec 2003 12:16:54 +0100

    > IE filters the certificates in the Personal store to list only those that
    > contain an associated private key.
    I've just found another security bug in CryptoAPI. :(

    1. I have imported one certificate in Personal store (medium security
    level),
    2. I have exported that certificate (with private key) into file,
    3. I have imported that certificate (with private key) into Personal store
    (with high security level and password set),
    4. Now, I'm able to sign using that certificate and there is no dialog
    asking me for the password. For example, Outlook 2000 will ask me for the
    password and my app will not!!! Signing is with the same certificate.

        So, certificate is not password protected.

    Best regards,
    Milan Tomic
    http://www.setcce.org

  • Next message: Martijn Remmen: "Re: Implementing WlxDisplayStatusMessage"

    Relevant Pages

    • Re: How to Install certificate?
      ... Bob is right that security admins don't like export of private keys...many ... export/import process. ... The sample code does not enable export/import of the private key. ... 2000/2003 Certificate enrollment server. ...
      (microsoft.public.pocketpc.wireless)
    • Re: Suppressing security dialogs when app opens
      ... "Adding the above two keys to the install makes the runtime install ... I'm not comfortable altering the security mechanism of a machine without the user's knowledge ... ... Because a digital certificate you create yourself isn't issued by a formal certification authority, ... Microsoft Office will only trust a self-signed certificate on a computer that has the private key for that certificate ...
      (comp.databases.ms-access)
    • Re: Strange problem with Private Key under w2k. Bug?
      ... In step 2 you're importing a certificate only into the Personal store, ... without any private key being associated with it. ... When, in step 3, you import the spc+pvk into the Personal store, you're ... key is to export it using CertMgr or MMC, and opting to delete the private ...
      (microsoft.public.platformsdk.security)
    • Re: CertEnumCertificatesInStore() and IE
      ... I have exported it into file WITHOUT private key, ... I have deleted my certificate from Personal store, ...
      (microsoft.public.platformsdk.security)
    • Re: Strange problem with Private Key under w2k. Bug?
      ... This posting is provided "AS IS" with no warranties, and confers no rights. ... > private key by exporting, ... > BTW, if I import certificate using pvkimprt without performing step 2, ... >> When, in step 3, you import the spc+pvk into the Personal store, you're ...
      (microsoft.public.platformsdk.security)