Search code examples
encryptioncertificatex509certificatemime

What is the effect on UI Prompts when group policy sets strong key protection in windows?

I am attempting see this question with 50% success to avoid using the windows dialog and entering passwords for certificate private keys through my own code.

I can do it with certificate stored on a smart card but am having no success with certificates stored in the PC. My question is why?

I see in this article it is explained the required process. Our group policy has set for us children users. When we import a certificate we get this window.

enter image description here

And when we use the certificate for example with Outlook this is seen

enter image description here

Further in Group Policy under security options the "Force strong key protection for user keys stored on the computer" has "User Must enter a password each time they use a key" Meaning each and every time I read an email and it needs such a certificate I need to enter the password.

For me a lowly .net programmer these things mean the user has to enter a password each time, but in windows/security person speak does this also mean that windows must supply the UI to do it? In other words when I attempt to add a password for a key whose certificate is stored on the PC it fails.

If I am correct so far what are the workarounds. Can the certificate be saved in file form and used? Can it be saved in a database and retrieved? Or is the only real alternative to store on a smart card where then the policy seems to be different.

Solution

  • does this also mean that windows must supply the UI to do it?

    yes, operating system will present private key access dialog (either, consent prompt or password input dialog).

    In other words when I attempt to add a password for a key whose certificate is stored on the PC it fails.

    it is unclear what exactly fails. What error message you get? Under what conditions?

    IIRC, you cannot add password to already installed certificate after policy enforcement. When you enforce the policy, only newly generated/requested certificates will require user input. When imported from PFX, there is an option to specify key protection flag. But once the certificate is installed, you cannot change this setting.