Re: Attaching private key to the existing certificate

From: Vishal Agarwal[MSFT] (vishala_at_online.microsoft.com)
Date: 02/29/04

  • Next message: Vishal Agarwal[MSFT]: "Re: Question about Cert Request" 
    Date: Sun, 29 Feb 2004 11:55:38 -0800

    You need to set CERT_KEY_PROV_INFO_PROP_ID property.

    Thanks,
    Vishal[MSFT] 

    -- 
This posting is provided "AS IS" with no warranties, and confers no rights
"Innokentiy Ivanov" <ivanov@eldos.org> wrote in message
news:eexF1ue$DHA.3668@TK2MSFTNGP09.phx.gbl...
> Hello!
>
> We are looking for solution of the following problem. Is there any way to
> add certificate and its private key to Windows certificate storage
> separately? I.e., on first step we add the certificate without private key
> and on the second step we "attach" the private key to just added
> certificate.
>
> We tried the following code, but it does not work for us:
>
> // HCERTSTORE hSystemStore
>
> // PCCERT_CONTEXT Cert;
>
> // "Certificate" is the instance of own-implemented X.509 certificate
class
>
> hSystemStore = CertOpenSystemStore(0, "ROOT");
>
> if (hSystemStore) {
>
> /* adding the "public" part of certificate (without private key) */
>
> if (!CertAddEncodedCertificateToStore(hSystemStore, X509_ASN_ENCODING,
> Certificate->GetBinary(), Certificate->GetBinarySize(),
CERT_STORE_ADD_NEW,
> &Cert)) {
>
> // error
>
> } else {
>
> /* Trying to attach a private key for just added certificate */
>
> SetPrivateKeyForCertificate(Cert, Certificate);
>
> }
>
> }
>
> //-------skipped-------
>
> void SetPrivateKeyForCertificate(PCCERT_CONTEXT Context,
CElX509Certificate
> *Cert)
>
> {
>
> HCRYPTPROV Prov;
>
> HCRYPTKEY Key;
>
> // creating GUID to use it as a container name
>
> // ....
>
> if (!CryptAcquireContext(&Prov, GuidStr, NULL, PROV_RSA, CRYPT_NEWKEYSET))
>
> {
>
> // error, exiting
>
> } else {
>
> // Cert->PrivateKey points to a MS Private key blob
>
> if (!CryptImportKey(Prov, Cert->PrivateKey, Cert->PrivateKeySize, 0,
> CRYPT_EXPORTABLE or CRYPT_USER_PROTECTED, &Key)) {
>
> CryptReleaseContext(Prov, 0);
>
> // error, exiting
>
> }
>
> if (!CertSetCertificateContextProperty(Context,
> CERT_KEY_PROV_HANDLE_PROP_ID, 0, &Prov)) {
>
> CryptDestroyKey(Key);
>
> CryptReleaseContext(Prov, 0);
>
> // error, exiting
>
> }
>
> CryptDestroyKey(Key);
>
> CryptReleaseContext(Prov, 0);
>
> }
>
> }
>
> All the routines, starting from CertOpenSystemStore and finishing on
> CertSetCertificateContextProperty return successful values. Certificate is
> added to the ROOT store but Win32 certificate manager does not show that
> private key is available for this certificate.
>
> Please advice us which routines we should use to make this possible.
>
> One more question: is there a "legal" way (like win32 CryptoAPI routine)
to
> convert pkcs#1 RSA private key to MS Key blob? Also it's desired to have
> such a routine for DSA private keys.
>
> Thank you.
>
> Sincerely yours,
>
> Innokentiy Ivanov
>
> EldoS Corp.
>
>
  • Next message: Vishal Agarwal[MSFT]: "Re: Question about Cert Request"

    Relevant Pages

    • RE: SIMple SSL question ??
      ... I believe your book is instructing you to keep the private key secure. ... you use the certificate request wizard in IIS to install the cert after it's ... the certificate that's just been installed. ... If an attacker retrievs the SSL certificate, ...
      (microsoft.public.dotnet.security)
    • RE: SIMple SSL question ??
      ... I believe your book is instructing you to keep the private key secure. ... you use the certificate request wizard in IIS to install the cert after it's ... the certificate that's just been installed. ... If an attacker retrievs the SSL certificate, ...
      (microsoft.public.dotnet.security)
    • Re: Certificates, Keys, Mobile Users, Intended Usage
      ... Option that you think about uses self signed EFS certificates. ... Better then exporting user's private key as backup is to setup DRA (Data ... there is no EFS certificate and it will generate a new one. ... Mobile computer users benefit from encrypting sensitive ...
      (microsoft.public.win2000.security)
    • Re: PFXExportCertStoreEx
      ... which contains the actual PFX and write that to the disk. ... methods to export certificate + private key from the IE store. ...
      (microsoft.public.platformsdk.security)
    • Re: How to programmatically retrieve certificate from system key store
      ... You can do this using P/Invoke and capi functions, or even simpler, ... > requires you to add the required certificate to the ClientCertificates ... > Because a certificate doesn't actually contain a private key, ... > installed in the system key store, ...
      (microsoft.public.dotnet.security)
    Loading