Re: AcquireCredentialsHandle (Schannel)

"Michael Bauers" <MichaelBauers@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message news:DF5B2235-8E38-4A01-9858-0EE52CB34691@xxxxxxxxxxxxxxxx

The platform SDK contains an example of using SSPI functions for SSL.

I have not been able to get it to work. I am only trying to get the server
portion to run, and I always fail early on, calling AcquireCredentialsHandle,
and getting back SEC_E_NO_CREDENTIALS.

Possible issues I can think of:
* There's some issue with the certificate I am using (Could be anything,
someone generated me a server authentication certificate for the purpose of
trying to get the sample code working; I don't even think I have a private
key associated with it, or know how that works)

That's a good thought. In order to use a certificate to identify a server, the process running the server must have a private key corresponding to that certificate.

* There's something wrong with my environment; I am running on a corporate
workstation with whatever rights are assigned to me

As long as you have access to the certificate and its associated private key, you don't need any particular rights in order to run a server that identifies itself using SSL.

I would strongly recommend that you find out how certificates and private keys work, if you're going to develop a solution that anyone else will use - there are several little traps that you can fall into along the way that will kill the security of your application if you work from a partial understanding.

I would recommend reading Eric Rescorla's book on SSL / TLS - while it doesn't address SSPI directly, everything in there is translatable into SSPI, and the book provides a very complete and thorough description of how to protect a network communication protocol using SSL / TLS.

Alun.
~~~~
--
Texas Imperial Software | Web: http://www.wftpd.com/
23921 57th Ave SE | Blog: http://msmvps.com/alunj/
Woodinville WA 98072-8661 | WFTPD, WFTPD Pro are Windows FTP servers.
Fax/Voice +1(425)807-1787 | Try our client software, WFTPD Explorer.

.

Relevant Pages

  • Re: Private key generation
    ... As I wrote in my first answer to that thread - there are many situations when key pair is generated on trusted server. ... identity based encryption) simply requires generation of private key on server... ... High assurance keys (especially these that afterward are split in multiple shares using secret sharing schemes) may also require use of specialized equipment and computers that runs in a tempest/EM shielded locations. ... Default scenario supported by Microsoft Certificate Server is the most standard CA mode when CA just signs X509 certificate with emedded public keys. ...
    (microsoft.public.dotnet.security)
  • RPC over HTTP, Microsoft solution
    ... Exchange Server 2003 RPC over HTTP Deployment Scenarios ... Place a check in the box next to 'Certificate Services' and click 'Yes' ...
    (microsoft.public.exchange.setup)
  • Re: Certificate key access under Network Service in IIS 6
    ... Haven't done that because I've been remoted in to the customer's server. ... It is likely the private key file but might be a registry key as well. ... I can get the signing process to work if I have the IIS Application Pool configured to run under SYSTEM but running under the preferred NETWORK SERVICE account the private key access of the certificate fails. ...
    (microsoft.public.dotnet.security)
  • Re: OWA 2003 w/ Smart Card Authentication.
    ... Exchange 2003 server via ActivSync. ... the IIS certificate. ... Whether or not authentication will succeed is completely dictated by ... Server's SSL certificate must be configured on root of v-server via ...
    (microsoft.public.exchange.connectivity)
  • Re: How to use certificates?
    ... I expect that server will know the client public key, ... > private key for that certificate. ...
    (microsoft.public.dotnet.framework.webservices.enhancements)