Can someone explain what makes up the anatomy of a certificate’s private key when the key itself is stored on an HSM? I’m using nShield in this example but I’m assuming the principals are the same for any HSM that creates certificates with HSM private key pointers.
There are two areas I’m having a hard time understanding and there isn’t much information out there…or I’m searching for the wrong keywords.
- When I open the certificate in the certificate manager (Windows) it shows that I do have a private key to the certificate. I realize this is just the pointer but, nevertheless, Windows recognizes the data as a valid private key, how is that possible? How does it fool Windows into thinking it’s a real private key?
- If I attempt to use the private key from the certificate (ie, to sign something) it redirects the private key operations to the HSM. I assume the CSP is responsible for this but how does the certificate know which CSP to use?
I’m trying to get a better understanding so I can write software that allows users to leverage certificates for crypto operations instead of having to rely on PKCS11 or the vendor’s API.