Difference between revisions of "Key Store"

From MgmtWiki
Jump to: navigation, search
(Windows)
(Windows)
Line 3: Line 3:
 
==Windows==
 
==Windows==
 
The original Windows Crypto API was build on RSA code by the AD team and treated certificates as the primary objects. Keys were depended from Certificates where were stored in the Windows Registry under either the Local Machine (HKLM) or or Current User (HKCU) branch. While the focus on Keys over Certificates changed with the CNG (Crypto Next Generation) code base and Key Store Objects appeared, the certificate language remained.
 
The original Windows Crypto API was build on RSA code by the AD team and treated certificates as the primary objects. Keys were depended from Certificates where were stored in the Windows Registry under either the Local Machine (HKLM) or or Current User (HKCU) branch. While the focus on Keys over Certificates changed with the CNG (Crypto Next Generation) code base and Key Store Objects appeared, the certificate language remained.
 +
* The best description of the storage locations at Microsoft comes from the Hardware signing team [https://docs.microsoft.com/en-us/windows-hardware/drivers/install/local-machine-and-current-user-certificate-stores Local Machine and Current User Certificate Stores.] Which also notes that "all current user certificate stores except the Current User/Personal store inherit the contents of the local machine certificate stores."
 +
*The inherited tool from AD [https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil certutil] is the most extensive set of capabilities for manipulating certificates.
 +
* [https://docs.microsoft.com/en-us/microsoft-desktop-optimization-pack/appv-v4/how-to-modify-private-key-permissions-to-support-management-server-or-streaming-server Permissions to Support Management Server or Streaming Server] contains a description of the use of WinHttpCertCfg.exe tool.
 +
* [WinHttpCertCfg.exe, a Certificate Configuration Tool WinHttpCertCfg.exe, a Certificate Configuration Tool] give the official description of the use of that tool.
 
{|border="1" padding="2" width="799px"
 
{|border="1" padding="2" width="799px"
 
|Physical||Logical store || Description of Contents
 
|Physical||Logical store || Description of Contents

Revision as of 07:55, 27 June 2020

Full Title or Meme=

Where Keys, Certificates and Bindings can be found on each Operating system.

Windows

The original Windows Crypto API was build on RSA code by the AD team and treated certificates as the primary objects. Keys were depended from Certificates where were stored in the Windows Registry under either the Local Machine (HKLM) or or Current User (HKCU) branch. While the focus on Keys over Certificates changed with the CNG (Crypto Next Generation) code base and Key Store Objects appeared, the certificate language remained.

  • The best description of the storage locations at Microsoft comes from the Hardware signing team Local Machine and Current User Certificate Stores. Which also notes that "all current user certificate stores except the Current User/Personal store inherit the contents of the local machine certificate stores."
  • The inherited tool from AD certutil is the most extensive set of capabilities for manipulating certificates.
  • Permissions to Support Management Server or Streaming Server contains a description of the use of WinHttpCertCfg.exe tool.
  • [WinHttpCertCfg.exe, a Certificate Configuration Tool WinHttpCertCfg.exe, a Certificate Configuration Tool] give the official description of the use of that tool.
Physical Logical store Description of Contents
My Personal certificates associated with a private key controlled by the user or computer.
Root Trusted Root Certification Authorities certificates from implicitly trusted certification authorities (CAs).
 ?? Enterprise Trust certificate trust lists typically used to trust self-signed certificates from other organizations.
CA Intermediate Certification Authorities certificates issued to subordinate CAs in the certification hierarchy.
 ?? Active Directory User Object the user object certificate or certificates published in Active Directory.
TrustedPublisher Trusted Publishers certificates from trusted CAs.
 ?? Untrusted Certificates certificates that have been explicitly identified as untrusted.
Root Third-Party Root Certification Authorities trusted root certificates from CAs outside the internal certificate hierarchy.
TrustedPeople Trusted People certificates issued to users or entities that have been explicitly trusted.
ADDRESSBOOK Other People certificates issued to users or entities that have been implicitly trusted.
REQUEST Certificate Enrollment Requests pending or rejected certificate requests.
FlightRoot Preview Build Roots
TestSignRoot Test Roots
eSIM Certification Authorities eSIM Certification Authorities
Homegroup Machine Certificates Homegroup Machine Certificates
Remote Desktop Remote Desktop
SmartCardRoot Smart Card Trusted Roots
SMS SMS
TrustedAppRoot Trusted Packaged App Installation Authorities
TrustedDevices Trusted Devices
WebHosting Web Hosting
WHSKeys WHSKeys
Windows Live ID Token Issuer Windows Live ID Token Issuer
Windows Web Management Windows Web Management
ClientAuthIssuer N/A
MSIEHistoryJournal N/A
Trust N/A

Java

Apple

References