Propagating certificates stored in a CNG Key Store Provider

Question

I am developing a CNG Key Store Provider (KSP) that will store keys and certificates remotely in a backend server in order to be used not only on Windows, but also on other OS without the need to export/import several times, every OS will have its own driver.

Currently I am investigating how to let Windows know that my KSP has personal certificates that must be available to other apps using the CryptoAPI, like browsers.

I have read that, when using smartcards, this procedure is done by the "Certificate Propagation Service", that notices when a smartcard is inserted, and then copies the certificates to the "MY" certificate store of current user.

How to do the propagation of certificates available in the KSP? If I call CertAddEncodedCertificateToStore asking to put the certificate in the "MY" store, will it do the trick persisting the certificate for future sessions? If so, I imagine that when some app call CryptAcquireCertificatePrivateKey with that certificate as parameter, the CryptoAPI will ask the KSP for a reference to the private key, right?

Answer 1

After digging a lot and making a lot of tests, I've finally found a way to "propagate" the certificate. This is what need to be done so that CryptoAPI knows that your KSP has user certificates:

1. Create a certificate context using CertCreateCertificateContext passing the DER encoding of desired certificate;

2. Create a CRYPT_KEY_PROV_INFO provInfo and set the fields:

   • Set pwszContainerName to a string of your choice, just to identify the key internally;
   • Set the field pwszProvName to the name of your provider. This is how CryptoAPI knows that the private key corresponding to this certificate is kept by your KSP;
   • Set dwKeySpec to AT_SIGNATURE;
   • The other fields can be NULL.

3. Associate the provInfo to the context by calling CertSetCertificateContextProperty using CERT_KEY_PROV_INFO_PROP_ID as the property ID;

4. Open the "MY" store by calling CertOpenSystemStore(NULL, L"MY")
5. Add the context to the store by calling CertAddCertificateContextToStore(hCertStore, pCertContext, CERT_STORE_ADD_REPLACE_EXISTING, NULL)

After this, the certificate will be available for use in any application compatible with the CryptoAPI, like some browsers. As an example, in Internet Explorer you can access the certificate list in: "Tools" menu > "Internet Options" submenu > "Content" tab > "Certificates" button > "Personal" tab.

Whenever the user wants to use that certificate to authenticate in a website (or other use), the CryptoAPI will call your KSP, passing a hash value to be signed be the private key.