"The associate private key cannot be found" error and "certutil -repairstore" failure with Windows certificate and key files?

Question

Old machine cannot boot into windows to perform a cert export. The cert file and key file have been retrieved from the file system and copied. Cert is for IE SSL access to a bank.

C:\Users{user}\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates

C:\Users{user}\AppData\Roaming\Microsoft\SystemCertificates\My\Keys

Certs show and claim to have private keys under properties, but export shows the key cannot be found, and when using the cert to access a Bank web site, the SSL handshake fails.

Wasn't sure so put keys here also:

C:\Users{user}\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-...

Using certutil the Key Container and exact file has been identified. However, repairstore command fails.

Also, hoping to find the location of where keys may be store, FindPrivateKey was used also but without luck:

"PrivateKey failed for the following reason: Unable to obtain private key file name"

Registry of old system has been backed up also. Trying to export certificate in Windows Repair mode command prompt failed also (certutil not found).

Thank you in advance.

Answer 1

Private keys stored as files in the roaming profile are encrypted with a "master key" that is regularly updated. The master key is itself encrypted with the user's password. This is described there. This encryption layer is probably the reason for the usage failures you observe: Windows sees the file, but, when trying to access it, fails to make sense of its contents because the master key it uses does not match the one which was actually used to encrypt the keys.

Now this has changed over the years, so maybe your situation might be salvageable, depending on the exact Windows versions involved. See this page for starters.

Assuming that there is no Microsoft-approved recovery method, then, apart from trying to reverse-engineer the poorly documented encryption system, your reasonable courses of action include either of the following:

• Create a virtual machine with the VM solution of your choice (e.g. VirtualBox), copy the complete disk from the now dead machine, and boot it in the VM. This is assuming that the machine hardware is dead, but the disk is still sane. Windows will probably complain about drivers and need to be booted in recovery mode or something like that. Once the machine is up, export the certificate and private key as a PFX (PKCS#12) file, and import it elsewhere. If the private key was not marked as "exportable" then this will require a bit of programming, though this is not as hard as it may seem at first glance.

• Simply ask for a new SSL certificate. This certificate is used for authentication; no data is lost when the private key is not available. The bank may issue another certificate that will be as functional as the previous one. If they charge you for that, then consider switching to another bank.