We were trying key export from Windows Certificate Store as part of a certificate module development. The code is in C++ and mostly WinCrypt and openssl APIs are used. I installed a certificate that has private key in my Local Machine certificate store (certlm.msc). When retrieving, it was seen that the export is failing. After a bit of analysis, it was identified that the issue is because of the "Enable strong private key protection option" that is set when we Import certificates to store.
In Current User store (certmgr.msc), I am able to check or uncheck this box and so export fails only for certificates that have this flag set. In Local Machine store (certlm.msc), I dont see an option to select. This option is greyed out by default. Also, the behavior (failure to export) suggests that it is acting as if the check box is checked.
Can someone shed some light on this issue? Is there any option to enable this check box for Local Machine certificate store(certlm.msc) as well? I could see that for Current User store (certmgr.msc), I was able to enable the checkbox via security policy settings.
I am able to export correctly if I run as administrator, but that is not a feasible solution for us. Any pointers towards a possible solution is also welcome.
Thanks in advance.
Update: If a certificate is already present in my local machine store, I start up my system and try to export the certificate and private key using powershell command I get the below prompt:
This does not come, if I run powershell as an Administrator.
Update2: Everytime I try to access the certificate with private key, I see an audit failure event getting logged. Event ID 5061 Cryptographic Operation: Operation: Open Key. Return Code: 0x80090016