Windows Machine Cert File Mappings - windows

Question

BLUF
If you know a windows machine certificate file name, can you view the file contents in the windows certificate store?
Background
I am working with the Windows 7+ VPN Client. It does not let you directly select the certificate that should be used for a connection and provides very limited feedback. The most notorious error RRAC is 13801 that roughly sums up to 'I don't like something about a certificate being used, but i am not going to tell you what exactly'.
Using the Event Viewer to view Security entries, I do see that there is a request for a certificate. Something like:
ProviderName Microsoft Software Key Storage Provider
AlgorithmName UNKNOWN
KeyName {#################}
KeyType %%2499
KeyFilePath C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\<filename>
Operation %%2458
ReturnCode 0x0
I was wondering how i could use the filename mentioned above to view the certificate properties (IE: see that the one i want is being used). Right now my only method is to import a certificate via mmc and see the new file being created at the time of import. I cannot use this trick for certificates that are already imported on the system.

Answer 1

All of the identifiers here are for the private key. The private key doesn't know where the certificate lives, because the architecture is that the cert object / cert store know where the private key is for a given certificate.
To see the mapping between certs in a cert store and the keys on the system you can use certutil -store, e.g.:
C:\>certutil -store my
my
================ Certificate 0 ================
...
================ Certificate 7 ================
Serial Number: 3451b93c10f9279348a949f729d1ff10
Issuer: CN=localhost
NotBefore: 1/26/2015 2:19 PM
NotAfter: 1/25/2020 4:00 PM
Subject: CN=localhost
Signature matches Public Key
Root Certificate: Subject matches Issuer
Template:
Cert Hash(sha1): 15 e3 4c d3 2d a7 54 99 a9 17 8f 17 26 25 63 25 8f 3a 94 28
Key Container = IIS Express Development Certificate Container
Unique container name: fad662b360941f26a1193357aab3c12d_1fcb2e07-cec4-4ba1-9c78-58a431e1aefd
Provider = Microsoft RSA SChannel Cryptographic Provider
Encryption test passed
CertUtil: -store command completed successfully.
Where the thing to match is Key Container in this output is the same as KeyContainerName in the event, and Provider in this output is ProviderName in the event.
You can also dump the user store (the default is the machine):
C:\>certutil -user -store -silent my
my
================ Certificate 0 ================
Serial Number: 0123456789abcdef
Issuer: E=issueremail#example.org, CN=cn.issuer.example.org, OU=ExampleOU, O=ExampleO, L=Locality, S=State, C=Country
NotBefore: 11/12/2013 6:15 AM
NotAfter: 12/13/2014 7:16 AM
Subject: E=subjectemail#example.org, CN=cn.subject.example.org, OU=ExampleOU, O=ExampleO, L=Locality, S=State, C=Country
Non-root Certificate
Template:
Cert Hash(sha1): ff 3d 35 54 54 fd ff ea 52 cd 71 6f e7 14 24 75 3f f7 fe cf
Key Container = {F76693EF-BDC3-4AEC-855A-3A2F65EB9C14}
Unique container name: 0148994a057f4e05acb6407550cdde40_1fcb2e07-cec4-4ba1-9c78-58a431e1aefd
Provider = Microsoft Enhanced RSA and AES Cryptographic Provider
Private key is NOT exportable
Encryption test passed
...
================ Certificate 51 ================
Serial Number: 0123456789abcdef
Issuer: E=issueremail#example.org, CN=cn.issuer.example.org, OU=ExampleOU, O=ExampleO, L=Locality, S=State, C=Country
NotBefore: 11/12/2013 6:15 AM
NotAfter: 12/13/2014 7:16 AM
Subject: E=subjectemail#example.org, L=Locality, S=State, C=Country
Non-root Certificate
Template:
Cert Hash(sha1): 2a 81 f8 d1 c7 40 13 2f 15 5a 5e 30 41 1a 2b 13 71 93 db 9e
Key Container = {2572D484-D352-4B32-BB00-236B755B7F81}
Unique container name: b11d717c1718a3bc6ad1769f2226998e_1fcb2e07-cec4-4ba1-9c78-58a431e1aefd
Provider = Microsoft Enhanced RSA and AES Cryptographic Provider
Private key is NOT exportable
Encryption test passed
In addition to the -user switch I specified -silent, because I have some smartcard backed certificates and I didn't want to deal with getting prompted for the card and PIN.