RE: Storing certificate on a hardware token (SC)
From: lelteto (lelteto_at_discussions.microsoft.com)
Date: 02/25/05
- Next message: Marilyne: "Windows 2003 - User Logins vs Software"
- Previous message: Vishal Agarwal[MSFT]: "Re: submit request to CertificateAuthority"
- In reply to: Noolyg: "Storing certificate on a hardware token (SC)"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Fri, 25 Feb 2005 10:03:40 -0800
The usual way is to get context to the token's CSP (each token vendor has its
own CSP handling its own token). Next you create a container and within that
container inject a dummy key pair then call CryptSetKeyParam with
KP_CERTIFICATE to add the cert to the key. This is if you want to store JUST
the cert (and you don't have the private key).
Now how normally you use the token is that you have the private key on the
token, too. In this case BEFORE the cert request you actually generate the
key pair on-token. The steps:
- acquire context for the token's CSP
- create a container on the token
- generate a key-pair on the token (within the new container)
- export the public key
- generate your cert request, send it to the CA and get back the cert
- acquire context to the token's CSP for the container you created
- get user key
- add the cert to the key (see above, CryptSetKeyParam)
Note that in order to use the certificate from generic Windows applications
(eg. IE, Outlook etc) you still would nned to COPY the certificate into the
'MY' store - and make sure that the cert property reflects the token's CSP.
>From that point on the applications will automatically use the token's CSP to
handle requests involving the cert (and corresponding private key).
Laszlo Elteto
SafeNet, Inc.
"Noolyg" wrote:
> Hello,
>
> I was wondering how to accomplish the following:
>
> After requesting a certificate using microsoft default Certificate
> Services (certcrv site), how do I make the certificate store on the
> token and not only in the MY cert store.
>
> Is there a programmatical solution?
> I've read about the "Certificate Enrollment Control" but don't think
> it is the way, I've also read somewhere that I can track the folder
> where microsoft stores the certificates (or their serials) and on
> change to copy the new certificate, but I was wondering if there's a
> better solution.
> Some how catching the event of saving a certificate in the MY store
> and moving it to the correct store.
>
> Thanks.
>
> Nool
>
- Next message: Marilyne: "Windows 2003 - User Logins vs Software"
- Previous message: Vishal Agarwal[MSFT]: "Re: submit request to CertificateAuthority"
- In reply to: Noolyg: "Storing certificate on a hardware token (SC)"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
