Re: CA's Key on Smart Card Problem

From: Steve Riley [MSFT] (steriley_at_microsoft.com)
Date: 01/22/05 

Date: Fri, 21 Jan 2005 20:39:37 -0800

This really isn't something we test. Specifically, the problem you're seeing
is because the CA runs as LocalSystem. But when you're getting the prompt
to enter the PIN, that's running in your user context.

More importantly, though, remember that the CA needs to access its own private
key every time it issues a certificate, so you'd need to leave the smartcard
in the reader all the time, which pretty much negates the reason for using
a smartcard.

Steve Riley
steriley@microsoft.com

> Hi.
> To improve the security of an offline root CA I want to
> store the CA's private Key on a Smart Card. During the
> installation process of the certificate services I
> selected a Smart Card CSP (Gemplus) and activated the
> checkbox "Allow this CSP to interact with the desktop".
> When the setup process generates the cryptografic key I
> have to enter the PIN of the Smart Card and then I got an
> error message box "An error occurred when setting the
> security access on the private key "Name of the CA", or
> the CSP selected does not support setting security access
> on private keys. Please make sure the CSP is installed
> correctly or select another CSP. Not implemented
> 0x80004001 (-2147467263)". After this the installation of
> the certificate services fails. I've already tried tested
> this with different Smart Cards and different Computers,
> but always got the same error.
> Can anyone help me with the error, or has anyone already
> installed the CA's Key on a Smart Card, which Smart Card
> and CSP shoud I use?
> Thanks in advance,
>
> Denis
>

Relevant Pages

  • CAs Key on Smart Card Problem
    ... store the CA's private Key on a Smart Card. ... installation process of the certificate services I ... checkbox "Allow this CSP to interact with the desktop". ...
    (microsoft.public.windows.server.security)
  • Smart Card in MS Certificate Services
    ... I want to customize the communication between the MS Certificate Services ... and Smart Card CSPs in order to use a in-house smart card access ... I guess I can implement a dummy CSP that simply forwards traffics ...
    (microsoft.public.platformsdk.security)
  • Re: CAs Key on Smart Card Problem
    ... As far as I know Microsoft is using HSMs for storing the root CA keys. ... advanced CSP may indeed be required. ... >> store the CA's private Key on a Smart Card. ...
    (microsoft.public.windows.server.security)
  • Re: windows programming cryptography(problem in implementing a Sma
    ... Normally your smart card should have on-board key pair generation, ... First,I should include it’s header file in CSP code as below: ... HCRYPTPROV and remember that it refers to your CSP and to the ...
    (microsoft.public.platformsdk.security)
  • Re: Smart card CSP register into Win2000
    ... You can call of your CSP functions ... As a CSP developer, you'll need to understand how to communicate with the ... smart card in order to provide the proper smart card CryptoAPI interface ...
    (microsoft.public.platformsdk.security)