3

On Windows, encryption machine keys are stored in: %ProgramData%\Microsoft\Crypto\RSA\MachineKeys

How do I determine the corresponding container name for each key?

I'm guessing this vagueness is by design--"security by obscurity"?

2

1 Answer 1

2
Foreach ($MachineCert In Get-ChildItem Cert:\LocalMachine -Recurse | Where HasPrivateKey)
{
    $MachineCert | 
       Select @{n='Subject';   e={ $MachineCert.Subject }},
              @{n='Container'; e={ $MachineCert.PrivateKey.CspKeyContainerInfo.UniqueKeyContainerName }},
              @{n='Store';     e={ $MachineCert.PSParentPath }}
}


Subject               Container                    Store                                                                                                     
-------               ---------                    -----                                                                                                      
CN=Ryan-Win81-2014    f686aa...9dfa-7c3d5dc833ac   Remote Desktop                                       
CN=localhost          fad662...9dfa-7c3d5dc833ac   My

Note that you probably need admin/UAC elevation before you're allowed to read certain properties of certain certificates.

I can't say for sure that the "vagueness" is by design, but it wouldn't surprise me. Most people don't understand what X509 certificates are or what private keys are, nor do most people care, unfortunately. By doing it for you, Windows can at least hide the private keys in a relatively secure location deep within the file system, since if most users had to deal with private keys themselves, they'd just leave their private keys sitting around on their desktops.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .