Trust model- Exporting keys & "Error during CryptAcquireContext"

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: Neil Crump (neilcrump_at_hotmail.com)
Date: 10/26/04 

Date: 26 Oct 2004 08:24:01 -0700

Hi,

I've recently enabled the trust model in our Platform Builder 4.2
project, and while it's working to a point, I'm unable to export my
certificates/keys and use them on another PC.

I'm currently generating working keys like this:

makecert -pe -sk MyKey -ss MyStore -e 01/01/2504 -n "E =
mail@client.com,CN = client,O = Client Ltd,C = UK" -eku
1.3.6.1.5.5.7.3.3 -a sha1 MyKey.cer

I've also successfully used Certificate Services from our Windows 2003
server, as long as I select 'specify container name', those keys work
too.

However, if I then export those certificates, they just won't work on
any other system.

Similarly, if I run:

makecert -pe -sv MyKey.pvk -ss MyStore -e 01/01/2504 -n "E =
mail@client.com,CN = Client,O = Client Ltd,C = UK" -eku
1.3.6.1.5.5.7.3.3 -a sha1 MyKey.cer

... And then use pvkimprt to install the CER and PVK files, that also
fails.

I see an error message "Error 80090016 during CryptAcquireContext!"
when I run signfile on such a system.

It seems to me that the problem is to do with the way that the
"Container Name" is used. I think that both MakeCert and Cert.
Services assign a container name to your key when you use them as
shown above.

However, if you use .CER/.PVK/PFX files, this information is lost, so
although you've successfully imported the certificates, you can no
longer refer to the key by container name.

Can anyone confirm this, or better, suggest a solution?

Thanks in advance,
Neil.

Relevant Pages

  • Re: PKI: the end
    ... that one of the keys is consistently kept private and the other ... How does PKI infer 3-factor? ... What's with the "business process" terminology? ... > case of domain name SSL certificates, ...
    (sci.crypt)
  • Re: Insecure IKE Implementations Clarification
    ... > issue is, of course, that SSH's model for authenticating host identities ... I have removed all CA certificates from my web browser and store ... > any means of using a hierarchy or web to validate host keys, ... CA set (as it happened with the web browser PKI). ...
    (Bugtraq)
  • Re: Effect of changing passwords
    ... Does it mean it deletes any cookies they have? ... which only the truly paranoid will even consider, nobody on the planet knows how to get at those certificates without your password. ... That means not even the people who wrote Windows. ... those keys aren't really yours; ...
    (microsoft.public.windowsxp.newusers)
  • Re: trust issues associated with Public Key Infrastructure?
    ... how can you trust, that the public key you have really ... CAs could issue certificates without checking owner identity ... Private keys could be disclosed by accident or on purpose ... False certificates could be inserted into browsers ...
    (comp.security.misc)
  • Re: EFS decryption problem solved!! FYI stuff inside.
    ... I'm suspecting that somewhere along the way new certificates (and keys) were ... domain recovery agent policy does not show up using the certificates mmc ... > encryption keys from the domain controller. ...
    (microsoft.public.security)