blocks|key|3239032|text|在我看来，您应该以另一种方式导入密钥。有关示例，请参阅http://support.microsoft.com/kb/950090。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|3239033|此外，我发现在UseMachineKeyStore中保存私钥是不好的。在大多数情况下，您需要导入证书与私钥在我的存储中的一些用户，并在根只导入证书没有私钥。|style|CODE|3239034|如果你确实需要将私钥保存在机器密钥库中，那么你至少应该保护密钥只供某些选定的用户读取，而不是每个人都可以读取。密钥容器只是文件系统中的一个文件(请参阅目录“%25ALLUSERSPROFILE%25\Microsoft\Crypto\Keys”中的文件)，该文件与NTFS中的其他文件一样具有安全描述符。要更改文件的安全描述符，可以使用CspKeyContainerInfo.CryptoKeySecurity属性和AddAccessRule、RemoveAccessRule等。|3239035|更新了：首先，很抱歉回答了这么长的问题。|BOLD|3239036|我可以把your+program+code分成两部分。在第一部分中，您将生成一个可用作CA证书的自签名证书，并将其保存为rootcert.pfx文件。在第二部分中，您将导入证书，但不使用rootcert.pfx，而是使用由先前创建的密钥的属性填充的RSACryptoServiceProvider。|3239037|我建议将代码的第二部分替换为更标准、更简单的代码:使用来自+rootcert.pfx+的私钥导入证书，如+中所述。它工作得非常好。|3239038|我不使用自己的BouncyCastle，所以我不能注释您代码的第一部分，但一般来说，您在代码中所做的事情也可以与Windows+SDK中的MakeCert.exe实用工具相关。你可以像下面这样做|3239039|MakeCert.exe+-pe+-ss+MY+-a+sha1+-cy+authority+-len+2048+-m+120+-r+-#+1
+++++++++++++-n+"CN=Some+Root+CA,+C=NL,+OU=BleedingEdge,+ST=Somewhere,+L=Somelane"|code-block|syntax|javascript|3239040|然后，您可以根据证书管理单元(用于mmc.exe)导出带有或不带有私钥的证书。在上面的例子中，我没有限制CA用于一些特殊的EKU，所以你可以不受任何限制地使用它，但是如果你确实需要这些限制，你可以只向MakeCert.exe添加额外的参数。您还可以使用MakeCert.exe创建用CA证书签名的其他证书。所以你只能就MakeCert.exe做一个小型的公钥基础设施。|3239041|在我看来，创建证书实际上是代码的一个单独部分。你的主要问题在第二部分。|3239042|如果你想导入CA证书，你应该考虑一些重要的事情：|3239043|3239044|您应该将其导入组织中每台(或多台)计算机上的Root中或localMachine中的AuthRoot中，但是应该导入不带私钥的证书。您可以针对以下|unordered-list-item|3239045|执行此操作|3239046|CertMgr.exe+-add+-c+CA.cer+-s+-r+localMachine+AuthRoot|3239047|3239048|您应该使用私钥将CA证书导入到one计算机上的计算机上，并仅将导入给将颁发其他证书(将使用CA的私钥签署新证书)的用户。一种用于导入CurrentUser.的My证书存储中的证书因此，计算机上的代码可能看起来像|3239049|3239050|如下所示：|3239051|//+import+PFX
X509Certificate2+cert+=+new+X509Certificate2+(@"c:\Oleg\rootcert.pfx",+"password",
++++X509KeyStorageFlags.MachineKeySet+%7C+X509KeyStorageFlags.PersistKeySet);
//+save+certificate+and+private+key
X509Store+storeMy+=+new+X509Store+(StoreName.My,+StoreLocation.CurrentUser);
storeMy.Open+(OpenFlags.ReadWrite);
storeMy.Add+(cert);

//+get+certificate+without+private+key
//+one+can+import+certificate+from+rootcert.cer+instead
byte[]+certBlobWithoutPrivateKey+=+cert.Export+(X509ContentType.Cert);
//+save+pure+certificate+in+Root+of+the+local+machine
X509Certificate2+certWithoutPrivateKey+=+new+X509Certificate2+(certBlobWithoutPrivateKey);
X509Store+storeRoot+=+new+X509Store+(StoreName.Root,+StoreLocation.LocalMachine);
storeRoot.Open+(OpenFlags.ReadWrite);
storeRoot.Add+(certWithoutPrivateKey);|3239052|如果您将StoreName.My和StoreLocation.CurrentUser更改为另一个值，代码将会正常工作，但我不建议您这样做。|3239053|一般而言，在.NET代码中导入证书看起来有点奇怪，并且没有显示将在幕后完成的工作。Windows只知道将私钥(与密钥对完全相同)保存在何处的Key+Containers，以及将保存证书的CSP和Certificate+Stores+(有关存储位置的信息，请参阅http://msdn.microsoft.com/en-us/library/bb204781.aspx+)。为了能够在证书库中保存有关密钥容器的信息，微软引入了名为Certificate+Extended+Properties的证书。如果在X509Certificate2的.NET属性中使用，如Thumbprint、FriendlyName、HasPrivateKey、Archived等，则使用证书的扩展属性。所以我建议您导入CA证书两次。一次是在Root或AuthRoot+中，不使用设置CERT_KEY_PROV_INFO_PROP_ID+Certificate+Extended+Properties，另一次是在My存储中使用设置私钥容器的位置信息(CERT_KEY_PROV_INFO_PROP_ID)。此外，你可以考虑在使用后直接删除私钥，只有当你真的需要使用它时才导入它，并且不永久持有它。所有这些对于拥有更好的安全性都很重要。|3239054|entityMap|0|LINK|mutability|MUTABLE|url|http://support.microsoft.com/kb/950090|1|http://testportal.curit.nl/Help/ConsoleApplication2.zip|2|http://msdn.microsoft.com/en-us/library/bfsktky3.aspx1.1.|3|4|http://msdn.microsoft.com/en-us/library/ms867086.aspx|5|http://msdn.microsoft.com/en-us/library/aa386971.aspx|6|http://msdn.microsoft.com/en-us/library/bb204781.aspx|7|http://msdn.microsoft.com/en-us/library/aa376523.aspx|8^0|R|12|0|0|7|I|0|4K|11|5O|D|62|G|0|0|3|0|3G|O|4|H|1|0|U|C|17|9|1H|C|0|1X|C|2|0|0|2S|C|3|0|0|0|0|M|4|S|C|16|8|1T|8|0|0|5|0|0|1I|0|0|0|7|C|2L|0|0|0|5|0|0|0|1X|4|C|H|P|0|0|AB|AC|X|BA|44|70|G|7S|A|83|C|8G|D|8U|8|9Y|4|A3|8|AJ|Q|CB|2|CU|Q|1Y|E|4|2P|I|5|3M|1H|6|5Y|V|7|BA|V|8|0^^$0|@$1|2|3|4|5|6|7|29|8|@]|9|@$A|2A|B|2B|1|2C]]|C|$]]|$1|D|3|E|5|6|7|2D|8|@$A|2E|B|2F|F|G]]|9|@]|C|$]]|$1|H|3|I|5|6|7|2G|8|@$A|2H|B|2I|F|G]|$A|2J|B|2K|F|G]|$A|2L|B|2M|F|G]]|9|@]|C|$]]|$1|J|3|K|5|6|7|2N|8|@$A|2O|B|2P|F|L]]|9|@]|C|$]]|$1|M|3|N|5|6|7|2Q|8|@$A|2R|B|2S|F|G]]|9|@$A|2T|B|2U|1|2V]]|C|$]]|$1|O|3|P|5|6|7|2W|8|@$A|2X|B|2Y|F|L]|$A|2Z|B|30|F|L]|$A|31|B|32|F|L]]|9|@]|C|$]]|$1|Q|3|R|5|6|7|33|8|@]|9|@$A|34|B|35|1|36]]|C|$]]|$1|S|3|T|5|U|7|37|8|@]|9|@]|C|$V|W]]|$1|X|3|Y|5|6|7|38|8|@]|9|@$A|39|B|3A|1|3B]]|C|$]]|$1|Z|3|10|5|6|7|3C|8|@]|9|@]|C|$]]|$1|11|3|12|5|6|7|3D|8|@]|9|@]|C|$]]|$1|13|3|-4|5|6|7|3E|8|@]|9|@]|C|$]]|$1|14|3|15|5|16|7|3F|8|@$A|3G|B|3H|F|G]|$A|3I|B|3J|F|G]|$A|3K|B|3L|F|G]|$A|3M|B|3N|F|L]]|9|@]|C|$]]|$1|17|3|18|5|6|7|3O|8|@$A|3P|B|3Q|F|L]]|9|@]|C|$]]|$1|19|3|1A|5|6|7|3R|8|@$A|3S|B|3T|F|L]]|9|@]|C|$]]|$1|1B|3|-4|5|6|7|3U|8|@]|9|@]|C|$]]|$1|1C|3|1D|5|16|7|3V|8|@$A|3W|B|3X|F|L]|$A|3Y|B|3Z|F|L]]|9|@]|C|$]]|$1|1E|3|-4|5|6|7|40|8|@]|9|@]|C|$]]|$1|1F|3|1G|5|6|7|41|8|@$A|42|B|43|F|L]]|9|@]|C|$]]|$1|1H|3|1I|5|U|7|44|8|@]|9|@]|C|$V|W]]|$1|1J|3|1K|5|6|7|45|8|@$A|46|B|47|F|L]|$A|48|B|49|F|G]|$A|4A|B|4B|F|G]]|9|@]|C|$]]|$1|1L|3|1M|5|6|7|4C|8|@$A|4D|B|4E|F|L]|$A|4F|B|4G|F|L]|$A|4H|B|4I|F|L]|$A|4J|B|4K|F|G]|$A|4L|B|4M|F|G]|$A|4N|B|4O|F|G]|$A|4P|B|4Q|F|G]|$A|4R|B|4S|F|G]|$A|4T|B|4U|F|G]|$A|4V|B|4W|F|G]|$A|4X|B|4Y|F|G]|$A|4Z|B|50|F|G]|$A|51|B|52|F|G]]|9|@$A|53|B|54|1|55]|$A|56|B|57|1|58]|$A|59|B|5A|1|5B]|$A|5C|B|5D|1|5E]|$A|5F|B|5G|1|5H]]|C|$]]|$1|1N|3|-4|5|6|7|5I|8|@]|9|@]|C|$]]]|1O|$1P|$5|1Q|1R|1S|C|$1T|1U]]|1V|$5|1Q|1R|1S|C|$1T|1W]]|1X|$5|1Q|1R|1S|C|$1T|1Y]]|1Z|$5|1Q|1R|1S|C|$1T|1Y]]|20|$5|1Q|1R|1S|C|$1T|21]]|22|$5|1Q|1R|1S|C|$1T|23]]|24|$5|1Q|1R|1S|C|$1T|25]]|26|$5|1Q|1R|1S|C|$1T|27]]|28|$5|1Q|1R|1S|C|$1T|27]]]]

It seems to me you should import the key in a little other way. See <a href="http://support.microsoft.com/kb/950090" rel="noreferrer">http://support.microsoft.com/kb/950090</a> for an example.

Moreover I find not good to save private key in <code>UseMachineKeyStore</code>. In the most cases you need import certificate with the private key in My store of some user and import in Root only certificate without private key.

It you do need save private key on Machine key store, that you should at least protect the key for reading only for some selected users and not from Everyone. The key container is just a file in the file system (see files in the diriectory "%ALLUSERSPROFILE%\Microsoft\Crypto\Keys") which has security descriptors like other files in NTFS. To change security descriptors of the files you can use <code>CspKeyContainerInfo.CryptoKeySecurity</code> property and <code>AddAccessRule</code>, <code>RemoveAccessRule</code> and so on.

UPDATED: First of all sorry for the long answer.

I could divide <a href="http://testportal.curit.nl/Help/ConsoleApplication2.zip" rel="noreferrer">your program code</a> in two parts. In the first part you generate a self-signed certificate which can be used as a CA certificates and you save it as rootcert.pfx file. In the second part you import the certificate, but use <code>RSACryptoServiceProvider</code> filled with properties of previous created key instead of using rootcert.pfx.

I suggest to replace the second part of your code to more standard and simple code: import certificate with the private key from rootcert.pfx like it described in <a href="http://support.microsoft.com/kb/950090" rel="noreferrer">http://support.microsoft.com/kb/950090</a>. It works very well.

I don't use myself the BouncyCastle, so I could not comment the first part of your code, but in general what you do in the code you could do also with respect of <a href="http://msdn.microsoft.com/en-us/library/bfsktky3.aspx1.1." rel="noreferrer">MakeCert.exe</a> utility from the Windows SDK. You can do like following

<pre><code>MakeCert.exe -pe -ss MY -a sha1 -cy authority -len 2048 -m 120 -r -# 1
 -n "CN=Some Root CA, C=NL, OU=BleedingEdge, ST=Somewhere, L=Somelane"
</code></pre>

Then you can export certificate with or without private key with respect of Certificate Snap-In (for mmc.exe). In the example above I don't restrict CA for some special EKU, so you can use it without any restriction, but if you do need the restrictions you can just add additional parameters to <a href="http://msdn.microsoft.com/en-us/library/bfsktky3.aspx1.1." rel="noreferrer">MakeCert.exe</a>. You can also use MakeCert.exe to create other certificate which are signed with the CA certificate. So you are able to make small PKI with respect of MakeCert.exe only.

It seems to me that creating of the certificate is really a separate part of your code. Your main problem is in the second part.

If you want import CA certificate you should take in consideration some important things:

<ul>
<li>You should import it in <code>Root</code> or <code>AuthRoot</code> in <code>localMachine</code> on every (or many) computer of your organization, but you should import the certificate without the private key. You can do this with respect of following</li>
</ul>

CertMgr.exe -add -c CA.cer -s -r localMachine AuthRoot

<ul>
<li>You should import CA certificate with private key on the computer on one computer and only for the user who will issue other certificates (who will sign new certificates with the private key of CA). One use to import the certificate in the My certificate store of CurrentUser. So the code on the computer could looks like </li>
</ul>

following:

<pre><code>// import PFX
X509Certificate2 cert = new X509Certificate2 (@"c:\Oleg\rootcert.pfx", "password",
 X509KeyStorageFlags.MachineKeySet | X509KeyStorageFlags.PersistKeySet);
// save certificate and private key
X509Store storeMy = new X509Store (StoreName.My, StoreLocation.CurrentUser);
storeMy.Open (OpenFlags.ReadWrite);
storeMy.Add (cert);

// get certificate without private key
// one can import certificate from rootcert.cer instead
byte[] certBlobWithoutPrivateKey = cert.Export (X509ContentType.Cert);
// save pure certificate in Root of the local machine
X509Certificate2 certWithoutPrivateKey = new X509Certificate2 (certBlobWithoutPrivateKey);
X509Store storeRoot = new X509Store (StoreName.Root, StoreLocation.LocalMachine);
storeRoot.Open (OpenFlags.ReadWrite);
storeRoot.Add (certWithoutPrivateKey);
</code></pre>

The code will work if you do will change <code>StoreName.My</code> and <code>StoreLocation.CurrentUser</code> to another values, but I don't recommend you to do this.

In general importing of certificates in .NET code look like a little strange and not shows what will be done under the hood. Windows knows only <a href="http://msdn.microsoft.com/en-us/library/ms867086.aspx" rel="noreferrer">Key Containers</a> where private keys (to be exactly the key pair) will be saved with respect of CSP and <a href="http://msdn.microsoft.com/en-us/library/aa386971.aspx" rel="noreferrer">Certificate Stores</a> where certificates will be saved (see <a href="http://msdn.microsoft.com/en-us/library/bb204781.aspx" rel="noreferrer">http://msdn.microsoft.com/en-us/library/bb204781.aspx</a> about location of the store). To be able to save information about the key container in the certificate store Microsoft introduced so named <a href="http://msdn.microsoft.com/en-us/library/aa376523.aspx" rel="noreferrer">Certificate Extended Properties</a>. If you use in .NET properties of <code>X509Certificate2</code> like <code>Thumbprint</code>, <code>FriendlyName</code>, <code>HasPrivateKey</code>, <code>Archived</code> and so on you work with the Extended Properties of the certificate. So I recommend you to import CA certificate twice. One in <code>Root</code> or <code>AuthRoot</code> without setting <code>CERT_KEY_PROV_INFO_PROP_ID</code> <a href="http://msdn.microsoft.com/en-us/library/aa376523.aspx" rel="noreferrer">Certificate Extended Properties</a> and one more time in <code>My</code> store with the setting of information about the place of Key Container with the private key (<code>CERT_KEY_PROV_INFO_PROP_ID</code>). Moreover you can consider to remove private key directly after the usage, import it only if you really need to use it and not hold it permanently. All this is important to have better security.

blocks|key|298174|text|我遇到过这个问题，似乎即使是运行FindPrivateKey工具的用户也没有访问密钥的权限，因此您会收到"Unable+to+obtain+private+key+file+name“消息。您可以将该工具作为LocalSystem进程运行。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|298175|更多信息请点击此处：|298176|http://www.itsolutionbraindumps.com/2011/02/finding-private-key-for-your.html|offset|length|298177|Dinko|298178|entityMap|0|LINK|mutability|MUTABLE|url^0|0|0|0|25|0|0|0^^$0|@$1|2|3|4|5|6|7|Q|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|R|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|S|8|@]|9|@$F|T|G|U|1|V]]|A|$]]|$1|H|3|I|5|6|7|W|8|@]|9|@]|A|$]]|$1|J|3|-4|5|6|7|X|8|@]|9|@]|A|$]]]|K|$L|$5|M|N|O|A|$P|E]]]]

I have encountered this problem and it seems that even the user with which you are running the FindPrivateKey tool does not have access to the key and therefore you would get the "Unable to obtain private key file name" message. You could run the tool as LocalSystem process.

More information here:

<a href="http://www.itsolutionbraindumps.com/2011/02/finding-private-key-for-your.html" rel="nofollow">http://www.itsolutionbraindumps.com/2011/02/finding-private-key-for-your.html</a>

Dinko

blocks|key|298180|text|我遇到了完全相同的问题，解决方案变得非常简单。我要做的就是通过|type|unstyled|depth|inlineStyleRanges|entityRanges|data|298181|X509KeyStorageFlags.MachineKeySet+%7C+X509KeyStorageFlags.PersistKeySet|code-block|syntax|javascript|298182|到X509Certificate2的ctor。现在您正在使用DotNetUtilities将bouncycastle证书转换为.net证书，但是helper方法使用DefaultKeySet+(而不是MachineKeySet+%2B+PersistKeySet+)创建.net证书。|298183|私钥的排列方式如下：|298184|var+cspParams+=+new+CspParameters
{
++++++KeyContainerName+=+Guid.NewGuid().ToString(),
++++++KeyNumber+=+(int)KeyNumber.Exchange,
++++++Flags+=+CspProviderFlags.UseMachineKeyStore
};

var+rsaProvider+=+new+RSACryptoServiceProvider(cspParams);|298185|我希望这能帮到你。|298186|entityMap^0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|Q|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|R|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|S|8|@]|9|@]|A|$]]|$1|I|3|J|5|6|7|T|8|@]|9|@]|A|$]]|$1|K|3|L|5|D|7|U|8|@]|9|@]|A|$E|F]]|$1|M|3|N|5|6|7|V|8|@]|9|@]|A|$]]|$1|O|3|-4|5|6|7|W|8|@]|9|@]|A|$]]]|P|$]]

I had exactly the same problem and the solution turned out to be really simple. 
All I had to do is to pass

<pre><code>X509KeyStorageFlags.MachineKeySet | X509KeyStorageFlags.PersistKeySet
</code></pre>

to X509Certificate2's ctor.
Now you are using the DotNetUtilities to convert the bouncycastle certificate to the .net one, but the helper method creates the .net cert with the DefaultKeySet (instead of MachineKeySet + PersistKeySet
).

And arrange the private key like this:

<pre><code>var cspParams = new CspParameters
{
 KeyContainerName = Guid.NewGuid().ToString(),
 KeyNumber = (int)KeyNumber.Exchange,
 Flags = CspProviderFlags.UseMachineKeyStore
};

var rsaProvider = new RSACryptoServiceProvider(cspParams);
</code></pre>

I hope this helps.

blocks|key|3024793|text|带&而不是%7C的新X509Certificate2(localPFXPath，inputPass，X509KeyStorageFlags.MachineKeySet+&+X509KeyStorageFlags.PersistKeySet)；适用于我。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3024794|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

new X509Certificate2(localPFXPath, inputPass, X509KeyStorageFlags.MachineKeySet &amp; X509KeyStorageFlags.PersistKeySet); with the &amp; instead of the | worked for me.

blocks|key|298204|text|通常，Root中的证书不会有私钥来管理。如果要在web请求中关联密钥，则应导入到我的文件夹。我有TLS/SSl异常，其中我有客户端证书链。如果您将所有证书链都存储在我的存储区中，那么我就摆脱了那个异常。用户帐户的问题所在。存储证书的实用工具使用当前用户帐户，而实际的应用程序在系统帐户上运行。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|298205|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

Usually Certificates in Root won't have private key to manage. You should import to My folder if you are associating key in the web request. I have TLS/SSl exception where I have chain of client certificates. If you store all the chain of certificates in My store then I got rid of that exception. Where the problem is with user accounts. Utility to store the certificates uses current user account and the actual application runs on system account.

blocks|key|3024839|text|基本问题是，.NET证书应用编程接口只是C%2B%2B+advapi32证书管理器应用编程接口的包装器，因此您无法指定传递给此应用编程接口的所有选项，该应用编程接口实际负责将证书粘贴到.NET证书存储中并持久化密钥。底线是，“UseMachineStore”选项需要传递给CspProviderFlags，而后者又传递给CAPI.CRYPT_MACHINE_KEYSET.这就是决定密钥是否真正持久化的小家伙。似乎有几个不同的原因导致即使您设置了X509KeyStorageFlags.PersistKeySet和MachineKeySet并可导出，此选项仍未设置。所有这些选项只有在愚蠢的密钥保留在C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\文件夹中时才有效。如果在导入时没有设置CRYPT_MACHINE_KEYSET，那么一旦GC处理完证书句柄，advapi32就会丢弃密钥。|type|unstyled|depth|inlineStyleRanges|offset|length|style|BOLD|entityRanges|data|3024840|解决方案:在将证书导入到个人计算机存储区之前，将证书添加到受信任的根目录。In+reading+the+logs+from+CAPI2，每次“导入”证书时，我都会看到两次对“X509+Objects”的调用。一个总是有<Flags+value="20"+CRYPT_MACHINE_KEYSET="true"/>+(我们想要的)，但是另一个没有，除非“验证链策略”没有返回错误。因此，看起来advapi32正在检查证书的“有效性”，要么返回一个被X509Certificate2+(I+love+how+many+empty+catch+blocks+they+have+in+that+code)吞噬的异常，要么advapi32单方面决定不保存不受信任证书的密钥。(顺便说一句，我怀疑这是20012到2008年之间的行为变化，但我还没有证明这一点。)为了解决这个问题，我在我的代码中添加了一个If-check来添加证书，如果Issuer等于Subject+(它是一个自签名证书)，那么在将证书添加到My之前，将证书添加到Root。|CODE|3024841|++++if+(certificate.Issuer.Equals(certificate.Subject))
++++{
++++++++using+(X509Store+store+=+new+X509Store(StoreName.Root,+StoreLocation.LocalMachine))+{+
++++++++++++store.Open(OpenFlags.ReadWrite);
++++++++++++store.Add(certificate);
++++++++++++store.Close();
++++++++}
++++}

++++using+(X509Store+store+=+new+X509Store(StoreName.My,+StoreLocation.LocalMachine)){+
++++++++store.Open(OpenFlags.ReadWrite);
++++++++store.Add(certificate);
++++++++store.Close();
++++}|code-block|syntax|javascript|3024842|注意:我发现如果使用而不是的证书中已经有主题密钥标识符，那么这是不必要的。不知何故，当您触发api来实际生成滑雪板而不是提交它时，它会触发条件，将神奇的CRYPT_MACHINE_KEYSET标志传递给advapi32。|3024843|entityMap|0|LINK|mutability|MUTABLE|url|https://blogs.msdn.microsoft.com/benjaminperkins/2013/09/30/enable-capi2-event-logging-to-troubleshoot-pki-and-ssl-certificate-issues/|1|http://referencesource.microsoft.com/#System/security/system/security/cryptography/x509/x509certificate2.cs,c99bf10e3e4c5c5e^0|4C|P|0|31|1B|11|U|0|6P|1L|1|0|0|A|3|0^^$0|@$1|2|3|4|5|6|7|Z|8|@$9|10|A|11|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|12|8|@$9|13|A|14|B|H]]|D|@$9|15|A|16|1|17]|$9|18|A|19|1|1A]]|E|$]]|$1|I|3|J|5|K|7|1B|8|@]|D|@]|E|$L|M]]|$1|N|3|O|5|6|7|1C|8|@$9|1D|A|1E|B|C]]|D|@]|E|$]]|$1|P|3|-4|5|6|7|1F|8|@]|D|@]|E|$]]]|Q|$R|$5|S|T|U|E|$V|W]]|X|$5|S|T|U|E|$V|Y]]]]

The basic problem is that the .NET certificates API is just a wrapper around the C++ advapi32 certificate manager api, so you don’t get to specify all the options that get passed to this api that is actually responsible for sticking the cert into the Windows cert store and persisting the keys. The bottom line is that the “UseMachineStore” option needs to get passed to the CspProviderFlags which in turn gets passed to the CAPI.CRYPT_MACHINE_KEYSET. This is the little guy that determines whether the key gets persisted for real or not. There seem to be several different reasons why this option doesn’t get set even though you set the X509KeyStorageFlags.PersistKeySet and MachineKeySet and Exportable. All these options only live as long as the stupid key stays in the C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\ folder. If CRYPT_MACHINE_KEYSET doesn’t get set at time of import then advapi32 blows the key away as soon as the certificate handle gets disposed by GC.

Solution: Add the certificate to the Trusted Root BEFORE you import the certificate into the Personal machine store. <a href="https://blogs.msdn.microsoft.com/benjaminperkins/2013/09/30/enable-capi2-event-logging-to-troubleshoot-pki-and-ssl-certificate-issues/" rel="nofollow noreferrer">In reading the logs from CAPI2</a>, I actually see two calls to “X509 Objects” every time the Certificate is “Imported”. One always has the <code>&lt;Flags value="20" CRYPT_MACHINE_KEYSET="true"/&gt;</code>, (what we want) but the other does not UNLESS “Verify Chain Policy” returns no errors. So it looks like advapi32 is checking the “validity” of the cert and either returns an exception that gets swallowed by X509Certificate2 (<a href="http://referencesource.microsoft.com/#System/security/system/security/cryptography/x509/x509certificate2.cs,c99bf10e3e4c5c5e" rel="nofollow noreferrer">I love how many empty catch blocks they have in that code</a>) or advapi32 just unilaterally decides to not persist the keys for untrusted certificates. (By the way, I suspect this is a behavior change between 2008 and 20012, but I haven’t proven that.) To work around this, I added an If-check to my code to add the certificate that if the Issuer equals the Subject (it is a self-signed cert) then add the cert to the Root before adding it to My.

<pre><code> if (certificate.Issuer.Equals(certificate.Subject))
 {
 using (X509Store store = new X509Store(StoreName.Root, StoreLocation.LocalMachine)) { 
 store.Open(OpenFlags.ReadWrite);
 store.Add(certificate);
 store.Close();
 }
 }

 using (X509Store store = new X509Store(StoreName.My, StoreLocation.LocalMachine)){ 
 store.Open(OpenFlags.ReadWrite);
 store.Add(certificate);
 store.Close();
 }
</code></pre>

Note: I have found that this is unneccessary if using a certificate that does not have a Subject Key Identifier already in it. Somehow when you trigger the api to actually generate the SKI instead of handing it in, it triggers the conditional to pass the magic CRYPT_MACHINE_KEYSET flag to advapi32.

I'm having problems inserting a new CA certificate with privatekey in the Root certificate store of the localmachine. 

This is what happens:

<pre><code>//This doesn't help either.
new StorePermission (PermissionState.Unrestricted) { Flags = StorePermissionFlags.AddToStore }.Assert();
var store = new X509Store(StoreName.Root, StoreLocation.LocalMachine);
privkey.PersistKeyInCsp = true;
//This shouldn't be necessary doesn't make a difference what so ever.
RSACryptoServiceProvider.UseMachineKeyStore = true;
cert.PrivateKey = privkey;
store.Open (OpenFlags.MaxAllowed);
store.Add (cert);
store.Close ();
</code></pre>

The certificate gets inserted and it all looks dandy: (see!) <img src="https://i.stack.imgur.com/eOtPT.png" alt="note it says it has a private key">

Note: is says it has a privatekey.

So you'd say one would be able to find it with <a href="http://msdn.microsoft.com/en-us/library/ms732026.aspx" rel="nofollow noreferrer">FindPrivateKey</a> 

<pre><code>C:\Users\Administrator\Desktop&gt;FindPrivateKey.exe Root LocalMachine -t "54 11 b1 f4 31 99 19 d3 5a f0 5f 01 95 fc aa 6f 71 12 13 eb"
FindPrivateKey failed for the following reason:
Unable to obtain private key file name

Use /? option for help 
</code></pre>

It's cute .... BUT IT'S WRONG!! (2 stupid dogs reference)

And the Certificate export dialog gives me this very fine message:
<img src="https://i.stack.imgur.com/WiYKn.png" alt="alt text">

This code is run while impersonating an administrator using this snippet: <a href="http://www.codeproject.com/KB/cs/zetaimpersonator.aspx" rel="nofollow noreferrer">click here</a>

I'd just love to know WHY?

(tested on Windows Server 2008 R2 &amp; Windows 7)

I'll be damned!

It works when I compile it to v3.5!!!!

What to do?

Inserting Certificate (with privatekey) in Root, LocalMachine certificate store fails in .NET 4

Windows Server

文件系统

Windows

容器

我在本地计算机的根证书存储中插入带有privatekey的新CA证书时遇到问题。这就是发生的事情：//This doesn't help either.new StorePermission (PermissionState.Unrestricted) { Flags = StorePermissionFlags.Ad...

问在.NET 4中，在根目录中插入证书(带有私有密钥)，LocalMachine证书存储失败
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问在.NET 4中，在根目录中插入证书(带有私有密钥)，LocalMachine证书存储失败EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问在.NET 4中，在根目录中插入证书(带有私有密钥)，LocalMachine证书存储失败
EN