<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body dir="auto">
Hi Pawel!
<div><br>
</div>
<div>
<blockquote type="cite">
<div dir="ltr"><font face="monospace"> I am quite new to OpenSSL on Windows and I did some research on the net to
<br>
solve my problem, but available knowledge seems to be limited.<br>
<br>
I need to to develop TLS 1.2 application using OpenSSL 1.0.2 (FIPS compliant version)
<br>
on Windows platform. I have requirement that it should get certificates, keys and<br>
CRLs from Windows cert store, and it should use TLS 1.2 EC-based suites.<br>
<br>
</font></div>
</blockquote>
<span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">Currently I’m developing a provider doing just that! But unfortunately, providers are OpenSSL 3.0.0 and up.</span></div>
<div><font color="#000000"><span style="caret-color: rgb(0, 0, 0);"><br>
</span></font>
<blockquote type="cite">
<div dir="ltr"><font face="monospace">I have some knowledge about crypto, TLS and OpenSSL but Windows integration is quite new for me.<br>
Correct me if I am wrong, but as far as I know there are, at least in theory, 2 ways<br>
of doing this:<br>
<br>
1) Get required cert/keys from Windows store using Windows API (Crypto API or CNG ?)<br>
and loat it to OpenSSL. I generated self signed certs/keys and imported them into Windows MY store.<br>
Getting certificates from there programmatically using WinAPI is quite easy and works (</font><font face="monospace"><span style="font-family:monospace"><span style="color:#000000;background-color:#ffffff;">CertFindCertificateInStore</span></span>, etc.),<br>
but is it possible to retrieve also corresponding private keys ? <br>
I see functions like </font><font face="monospace"><span style="font-family:monospace"><span style="color:#000000;background-color:#ffffff;">CryptExportPKCS8Ex, but it seems they are marked as
</span>deprecated.<br>
Is there any working example of retrieving specific key using it ?<br>
Or perhaps it would b e easier to use CNG API to do it ?<br>
</span></font></div>
</blockquote>
<div><br>
</div>
You will find that exporting private keys is sometimes forbidden by the policy set on its import. So you’ll be only able to get a CNG handle of that key. The handle can later be used with CNG hashing and signing functions only. I’m not sure that capi engine
does this.</div>
<div><br>
</div>
<div>As to selecting a specific key, I found out that with CNG the easiest non-deprecated way is enumerating them and selecting the key matching your criteria (public key match etc.).</div>
<div><br>
<blockquote type="cite">
<div dir="ltr"><font face="monospace"><span style="font-family:monospace"></span>2) Using OpenSSL directly with CryptoAPI engine (capi).<br>
Setting capi engine I was able to sign and verify signatures using RSA certs/keys,<br>
but it seems that </font><font face="monospace"><font face="monospace">CryptoAPI</font> (and capi engine using it) does not support EC.<br>
</font></div>
</blockquote>
From a quick look at the CNG documentation (<a href="https://learn.microsoft.com/en-us/windows/win32/seccng/cng-algorithm-identifiers">https://learn.microsoft.com/en-us/windows/win32/seccng/cng-algorithm-identifiers</a>) it seems that ECDSA is supported, although
to be fair I only experimented with RSA keys.</div>
<div><br>
</div>
<div>I’m writing this in a hurry, so take everyting with a grain of salt.</div>
<div><br>
</div>
<div>Cheers,</div>
<div>Ladislav Marko</div>
<div><br>
</div>
<div>
<blockquote type="cite">
<div dir="ltr"></div>
</blockquote>
</div>
</body>
</html>