Search code examples
certificatetokendigital-signature

How to check if a digital signature token has signing and encryption

I have a dsc token, im aware that they can be only signing, or they can be signing and encryption. How do i check?

Solution

  • KeyUsageFlag for X509 certificate is a bitwise flag.

    Please refer: X509KeyUsageFlags Enum

    There can be a single certificate with both the flag set (addation of values for DigitalSignature and KeyEncipherment) i.e. 128 + 32 or two different certificates. This depends on how Certifying Authority choses to issue the certificate.

    How do i check?

    Method 1: You must have Smartcard or USB Token driver installed which pushesh Certificates in token to Windows Certificate Store on inserting the token. Then run certmgr.msc to open Certificate Manager; go to Personal Certificates, double click the required certificate to open the Certificate Details and check Key Usage property in Details tab. Values displayed here are in Hex. like: Digital Signature (80)

    Method 2: You may filter on key values and check as above.

    Install Signer.Digital Browser Extension as described here

    Once Extension is installed and available in the browser, open any site so that browser loads extension script and execute below commands from the console of the browser

    SignerDigital.getSelectedCertificate("", 32) - to list only Encryption Certificates SignerDigital.getSelectedCertificate("", 128) - to list only DigitalSignature Certificates.

    Here 32 and 128 are X509KeyUsageFilter values as discussed above.