How can i create a SecIdentityRef object to use with SSLSetCertificate?
I have load the server certificate an private key using SecItemImport from separate PEM files, but haven't import then into the keychain.
It's possible to create the SecIdentityRef without importing the files into the keychain?
Seems that SecIdentityCreateWithCertificate can be used when the private key is in the keychain, and that SecItemImport or SecPKCS12Import can return an SecIdentityRef when importing PKCS #12 blob.
So my preference will be to work with the PEM files, and avoid import the key into the keychain if possible.
Related
I have a pretty simple scenario/requirement:
Generate RSA private/public key pair through OpenSSL or any online RSA key pair generator
Save the private key to the windows internal store (so it does not lay around as just a file somewhere
Create a PowerShell script, that looks into the store, locates the key, and uses it.
(basically, I will have a PS script, to which I send a 3rd party tool already encrypted password, and I expect that PS script to decrypt that password using a locally stored private key and use it on-the-fly)
This so far showed an unreachable goal, because:
I haven't found a way, how to import .pem file with the key
.cer file apparently does not contain the key
the only way (so far what I have found) how to import the key is conversion to .pfx file, which can be imported, BUT
.pfx file cannot be read as plain text - there seems to be no reasonable way from Powershell to locate the key and read it for usage in decryption
there is a module PSPKI, but it seems to accept the file and not the stored/installed certificate/key.
So anyone has any idea, how can I import a simple private key to Windows for later read-out from PowerShell for further usage?
Thank you!
Have a look at this class to load the PFX: https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.x509certificates.x509certificate2?view=net-7.0
$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("c:\my.pfx", "password");
Next step is to open the store. After you checked which one fits best (machine or user) you can use X509Store to read and write there. Do not forget the Open method. When a certificate with private key (off) is added the key ist stored and the file can be deleted.
I am trying to validate my app after archive in xcode. But it throughs error like
I am using mac for first time and dont know what is happening.
CAn somebody please ans the question. (I have searched a lot but no ans)
It is exactly saying 'distribution' private key is missing.
for the red marked certificate. Whoever created the distribution certificate will be having the private key in their key chain. get the certificate and private key (both selected)export as .p12 file. remove the current public certificate and import the exported file into keychain
We have Windows code which is heavily based on Crypt* API and keys stored in HCRYPTPROV (asymmetric, both public and private parts). The keys are normally imported from external source using CryptImportKey().
Note: The safety of the source providing this key is out of topic here. Let's say it is safe enough for our purposes.
Now with development going on we need to adopt keys coming from X.509 certificates. Currently code loads certificate into HCERTSTORE through PFXImportCertStore() or obtains it from online CA and then certificate itself can be accesses as CERT_CONTEXT through CertEnumCertificatesInStore.
But I completely failed to find a way to move keys from certificate into HCRYPTPROV. Any ideas are extremely welcome.
Regards,
HCRYPTPROV is just a pointer. You cannot move keys there.
Have you tried to use the IntPtr property X509Certificate2.Handle yet?
I used the following answer (https://stackoverflow.com/a/201277/99344) to generate a certificate and sign my exe.
I need to give the public key to a third party.
I have .pvk and .cer files. How do I extract the public key?
Thanks.
OK so I found some documentation that says that the .cer file only contains the public key so it is what I wanted.
How do I transfer both private / public keys from one mac to the other?
I know how to export the private key to .p12 with Keychain Access, and then when I double click it in the destination mac, it's added to Keychain Access.
However, when I export the public key to .pem file, double clicking it in the destination mac just spits out:
An error has occurred. Unable to import an item. The contents of this item cannot be retrieved.
When I tried the solution of security import pub.pem -k login.keychain, it said 1 key imported., but it doesn't show on Keychain Access.
Am I missing anything?
Should I not bother with transferring the public key?
Is importing just that private key enough?
Is the only way just recovering the public key from the private key?
Thanks
According to this, it looks like when running the security import... command, it's added to the keychain with the generic name Imported Public Key.
Now you just need to rename it to the relevant one (e.g. like the private key name).