0

We were trying key export from Windows Certificate Store as part of a certificate module development. The code is in C++ and mostly WinCrypt and openssl APIs are used. I installed a certificate that has private key in my Local Machine certificate store (certlm.msc). When retrieving, it was seen that the export is failing. After a bit of analysis, it was identified that the issue is because of the "Enable strong private key protection option" that is set when we Import certificates to store.

Cert Import Wizard - Local Machine Store

In Current User store (certmgr.msc), I am able to check or uncheck this box and so export fails only for certificates that have this flag set. In Local Machine store (certlm.msc), I dont see an option to select. This option is greyed out by default. Also, the behavior (failure to export) suggests that it is acting as if the check box is checked.

Can someone shed some light on this issue? Is there any option to enable this check box for Local Machine certificate store(certlm.msc) as well? I could see that for Current User store (certmgr.msc), I was able to enable the checkbox via security policy settings.

I am able to export correctly if I run as administrator, but that is not a feasible solution for us. Any pointers towards a possible solution is also welcome.

Thanks in advance.

Update: If a certificate is already present in my local machine store, I start up my system and try to export the certificate and private key using powershell command I get the below prompt:

enter image description here

This does not come, if I run powershell as an Administrator.

Update2: Everytime I try to access the certificate with private key, I see an audit failure event getting logged. Event ID 5061 Cryptographic Operation: Operation: Open Key. Return Code: 0x80090016

Regards, Amal

Improve this question
4
  • 1
    So your custom application requires to export the private key because it uses OpenSSL instead of WinCrypt only? Typically users posting questions here want to improve security of their program, not to make it make it insecure. Are you sure this is really necessary, may be your program should better run using a service account and then use the user specific certificate store?
    – Robert
    Commented Apr 12, 2022 at 11:19
  • Hi Robert, The applications secure library uses openssl to set TLS secure communication. Also, it was decided that we will use windows certificate store to store certificates instead of using physical files.
    – Amal Jesudas
    Commented Apr 12, 2022 at 18:11
  • It seems it is enforced as a part of default Local or group policy on the system. You can change this option by Local/Group Security Policy→System Cryptography→ Force strong key protection for user keys stored on the computer. Select the option as per your requirements.
    – sau_t
    Commented Apr 12, 2022 at 20:14
  • Hi Saurabh, That setting helps to change for User Account store. For Local Machine store it is Not defined and not editable(at least with my privileges).
    – Amal Jesudas
    Commented Apr 13, 2022 at 4:33

2 Answers 2

Reset to default
1

First of all, you misunderstand what "Enable strong private key protection option" means and how it works. It doesn't prevent the private key to be exported. It is second "Mark private key as exportable" controls the export option.

Private key strong protection means that you will be prompted for either, a consent or password input every time the private key is used for whatever enumeration (internally, every time when you acquire private key's context).

You SHALL NOT enable private key strong protection for machine certificate (hence it is grayed out in certlm.msc). This is because local machine store is often used by system services executed under Local System account. If you enable strong protection, a consent/password popup will be shown on current user's desktop (local system's desktop) which is different than logged-on user's desktop. As the result no one can interact with system's desktop, because it is hidden and any attempt to use the key will fail. This is why the strong protection option is grayed out for local machine store.

Improve this answer
7
  • Thanks Vadims. Actually the behavior is a little strange. I install a certificate in local machine store and am able to export the certificate and key. Now if I restart the system and try to export, it fails. If I run my application with Admin privilege, I am able to export the certificate. I now understand that private key protection is not to be enabled for local machine. But if I restart my system and run powershell commands (without admin privilege) to export the certificate from local machine store, I see the prompt that should occur only if "Enable strong private key protection" is set!
    – Amal Jesudas
    Commented Apr 12, 2022 at 18:05
  • One more help - can you direct me to some documentation that mentions that "Enable private key strong protection" is not to be set for local machine store and hence the option is greyed out by default. I was searching for such documentation but had no luck.
    – Amal Jesudas
    Commented Apr 12, 2022 at 18:07
  • What kind of prompt? Can you update your question with more details. Keep in mind that public certificate export is always free. Only private key export requires consent/password.
    – Crypt32
    Commented Apr 12, 2022 at 18:08
  • Hi Vadims, I have edited the question to include the confirmation dialog that I get when exporting using powershell scripts. And yes, I need both the public certificate and private key.
    – Amal Jesudas
    Commented Apr 12, 2022 at 18:18
  • Hi Vadims, Have a new input - I am seeing audit failure event getting logged, everytime I try and fail to access the certificate and private key from Local Machine store. Event ID: 5061 Cryptographic Operation: Operation: Open Key. Return Code: 0x80090016
    – Amal Jesudas
    Commented Apr 18, 2022 at 19:06
0

After 2-3 days, was finally able to find a workaround/solution to the problem. The actual reason was the permission for the Machine Key directory. On giving Full Control permission to Everyone, the issue was solved and now am able to access private key even after system restart. Refer: https://docs.microsoft.com/en-us/previous-versions/visualstudio/visual-studio-2008/bb909654(v=vs.90)?redirectedfrom=MSDN on how to change permissions.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .