We are currently developing a custom KSP (Key Storage Provider) for a Key Storage System. We successfully developed a CSP (CryptoAPI) and a KSP (CryptoNG) provider, and both work really fine for digital signatures and SSL on Outlook, Google Chrome, Microsoft Office, Java Applets and any other application that we have tested.
However, we are having problems with Internet Explorer 11 (latest version), when we try to use the certificate associated with our CSP/KSP to client SSL authentication. The certificate does appear on the default Windows List, however, after selecting it the page just fails to load.
In the event log, there is an Error event from Schannel with ID 36870 and the following message:
A fatal error occurred when attempting to access the SSL client credential private key. The error code returned from the cryptographic module is 0x8009030D.
I´ve searched the internet and found many related problems with Microsoft provider key files permission issues, mostly with answers for SERVER keys and not CLIENT keys, that have similar error codes but are not the same problem.
Please note also that the problem is with a custom KSP, not default Microsoft software implementations.
Some extra info that may be relevant:
- The KSP should be writing some logs to the user folder just after it is loaded. But that does not seem to work, there are no logs. I´m not sure if it is not being loaded at all or just can't write things to the system. It also should read a config file from the same location.
- The KSP should show dialogs and also use the internet (webservices), but that also does not happens. Maybe some IE security restriction on loaded DLLs (after all, a CSP/KSP is a DLL that is loaded) that I could not find any documentation about?
- The KSP is signed with a Windows recognized software signing certificates; And as mentioned, the windows system recognizes and works with it fine using any other Windows software except IE.
- Remember it works with any other software we have tried, including Microsoft ones. I´m also able to do debug it using Visual Studio attached to other software, but it does not work on Internet Explorer.
If I can provide any more helpful info for this, ask me. I´m aware and looked at most of the internet resources related to event id 36870 and error code 0x8009030d, I´ve spent a lot of time looking at them before posting this and the proposed solutions always involve permissions on Microsoft provider folder (does not apply) and/or are related to the server, and not client keys. Links are appreciated if they add information that is not associated with those more common, but unrelated issues.
The KSP/CSP has also been tested on other computers with the same errors, so it does not look like a problem on this IE, but a more generic problem.