CryptoAPI / Certificate chain install question..

From: Jayant Sane (JayantSane_at_discussions.microsoft.com)
Date: 06/25/04 

Date: Fri, 25 Jun 2004 09:52:01 -0700

I have a certificate chain in form of a pkcs7. And I want to install various certificates in appropriate certificate stores (Personal, Intermediate CAs, Trusted Root CAs).

What is the best way of doing it using CryptoAPI methods?

First option I was thinking was to build a chain using CertGetCertificateChain function and then distribute the certs to appropriate stores since they would arranged from the leaf to the root.
Other option was to figure out myself which is leaf, which is intermediate CA and which is root and then install them to the stores.

Thanks
Jayant

Relevant Pages

  • Re: Need a second privileged root certificate for WM5 device
    ... The Privileged/Unprivileged and SPC stores are the ones that deal with code execution, and they do not care if the cert is a self-signed root or not. ... If you put a certificate into "Privileged ... Execution Trust Authorities stores? ...
    (microsoft.public.pocketpc.developer)
  • Re: testing a CSP on Windows Server 2003
    ... Does the certificate exist in the trusted root CAs for the computer account ... I created a Certificate Authority on my Windows Server ...
    (microsoft.public.platformsdk.security)
  • Re: Signtool doesnt add entire chain when signing files
    ... you only need to ensure that the intermediate certificates are included in the signature so that the client can build a chain to the root. ... The root needs to be installed as a trusted root certificate on the client in order for the client to trust the certificate. ... Given that you don't have any intermediate certificates, it doesn't matter or not whether they are included in the signature so it should not matter if there is any difference between the wizard mode and the command line tool mode. ...
    (microsoft.public.platformsdk.security)
  • Re: Schannel CertificateChainValidation failing
    ... I am not fully up to speed with certs (root, end entity, ... valid Windows trusted root cert. ... You've enabled certificate revocation checking, and the validation code ...
    (microsoft.public.platformsdk.security)
  • Re: Certificate chain issue with Ent Sub Ca & stand alone Root CA
    ... certificate and I get a "Cannot verify certificate chain. ... revocation because the revocation server was offline. ... the root ca? ... Online>>> Online Enterprise Subordinate CA ...
    (microsoft.public.windows.server.security)