Key Store - Revision history

Tom at 19:47, 8 March 2023

2023-03-08T19:47:06Z

Tom: /* Windows */

2022-12-15T00:40:31Z

‎Windows

Tom: /* Windows */

2022-12-15T00:38:41Z

‎Windows

Tom: /* Windows */

2022-12-15T00:31:34Z

‎Windows

Tom: /* Apple */

2021-03-23T18:12:25Z

‎Apple

Tom: /* Linux */

2021-03-23T18:11:18Z

‎Linux

Tom: /* Apple */

2021-03-23T18:10:53Z

‎Apple

Tom: /* Windows */

2021-03-18T01:46:41Z

‎Windows

Tom: /* Windows */

2020-07-31T16:04:53Z

‎Windows

Tom: /* Windows */

2020-07-31T16:02:56Z

‎Windows

@@ Line 6: / Line 6: @@
 * The best description of the storage locations at Microsoft comes from the Hardware signing team [https://docs.microsoft.com/en-us/windows-hardware/drivers/install/local-machine-and-current-user-certificate-stores Local Machine and Current User Certificate Stores.] Which also notes that "all current user certificate stores except the Current User/Personal store inherit the contents of the local machine certificate stores."
 * Note that some user virtual accounts, like the one used for IIS web sites, do not have a "user account" on windows and so cannot store certificates in the "Current User" registry as it does not exist.
-*The inherited tool from AD [https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil certutil] is the most extensive set of capabilities for manipulating certificates from Microsoft. But its functionality is oriented to Windows AD and so is missing some of the functionality of OpenSSL.
+*The inherited tool from AD [https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil certutil] is the most extensive set of capabilities for manipulating certificates from Microsoft. But its functionality is oriented to Windows AD and so is missing some of the functionality of [[OpenSSL]].
 * [https://docs.microsoft.com/en-us/microsoft-desktop-optimization-pack/appv-v4/how-to-modify-private-key-permissions-to-support-management-server-or-streaming-server Permissions to Support Management Server or Streaming Server] contains a description of the use of WinHttpCertCfg.exe tool. That tool is oriented to device driver signing as, as a result, has its own idiosyncrasies and limitations.
 * The properties stored with the CngKey in the private key store include:
@@ Line 107: / Line 107: @@
 Even more chaotic than Windows. Good luck trying to make any sense of all the different varieties.
-The open source tool OpenSSL is perhaps the most generally useful tool for converting among the many different formats that have arisen over the years.
+The open source tool [[OpenSSL]] is perhaps the most generally useful tool for converting among the many different formats that have arisen over the years.
 ==References==
 [[Category:Security]]

@@ Line 10: / Line 10: @@
 * The properties stored with the CngKey in the private key store include:
 {|border="1" padding="2" width="799px"
 |Algorithm	||Gets the algorithm that is used by the key.
 |-

@@ Line 9: / Line 9: @@
 * [https://docs.microsoft.com/en-us/microsoft-desktop-optimization-pack/appv-v4/how-to-modify-private-key-permissions-to-support-management-server-or-streaming-server Permissions to Support Management Server or Streaming Server] contains a description of the use of WinHttpCertCfg.exe tool. That tool is oriented to device driver signing as, as a result, has its own idiosyncrasies and limitations.
 * The properties stored with the CngKey in the private key store include:
+{|border="1" padding="2" width="799px"
 * The documentation of [https://docs.microsoft.com/en-us/windows-hardware/drivers/install/local-machine-and-current-user-certificate-stores WinHttpCertCfg.exe, a Certificate Configuration Tool] gives the official description of the use of that tool.
 {|border="1" padding="2" width="799px"

@@ Line 8: / Line 8: @@
 *The inherited tool from AD [https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil certutil] is the most extensive set of capabilities for manipulating certificates from Microsoft. But its functionality is oriented to Windows AD and so is missing some of the functionality of OpenSSL.
 * [https://docs.microsoft.com/en-us/microsoft-desktop-optimization-pack/appv-v4/how-to-modify-private-key-permissions-to-support-management-server-or-streaming-server Permissions to Support Management Server or Streaming Server] contains a description of the use of WinHttpCertCfg.exe tool. That tool is oriented to device driver signing as, as a result, has its own idiosyncrasies and limitations.
 * The documentation of [https://docs.microsoft.com/en-us/windows-hardware/drivers/install/local-machine-and-current-user-certificate-stores WinHttpCertCfg.exe, a Certificate Configuration Tool] gives the official description of the use of that tool.
 {|border="1" padding="2" width="799px"

@@ Line 71: / Line 71: @@
 ==Apple==
-Apple calls this a Keychain. The metaphor is the chain that one puts physical keys on to keep them together.
+Apple calls this a Keychain. The metaphor is the chain on which one puts physical keys to keep them together.
 * [https://discussions.apple.com/thread/4376377 How to clear Safari SSL client certificate cache?] 2014-05-01 I found it by typing part of the domain name into the search box of Keychain, and it shows up a Kind called "Identity Preference".

@@ Line 75: / Line 75: @@
 ==Linux==
-Even more chaotic than Windows. Good luck trying to made any sense of all the different varieties.
+Even more chaotic than Windows. Good luck trying to make any sense of all the different varieties.
 The open source tool OpenSSL is perhaps the most generally useful tool for converting among the many different formats that have arisen over the years.

@@ Line 46: / Line 46: @@
 | SmartCardRoot || Smart Card Trusted Roots ||
 |-
-| SMS || SMS ||
+| SMS || SMS || [https://krebsonsecurity.com/2021/03/can-we-stop-pretending-sms-is-secure-now/ SMS is easy to hijack] and should not be used for security purposes.
 |-
 | TrustedAppRoot || Trusted Packaged App Installation Authorities ||