On Windows, encryption machine keys are stored in: %ProgramData%\Microsoft\Crypto\RSA\MachineKeys
How do I determine the corresponding container name for each key?
I'm guessing this vagueness is by design--"security by obscurity"?
On Windows, encryption machine keys are stored in: %ProgramData%\Microsoft\Crypto\RSA\MachineKeys
How do I determine the corresponding container name for each key?
I'm guessing this vagueness is by design--"security by obscurity"?
Foreach ($MachineCert In Get-ChildItem Cert:\LocalMachine -Recurse | Where HasPrivateKey)
{
$MachineCert |
Select @{n='Subject'; e={ $MachineCert.Subject }},
@{n='Container'; e={ $MachineCert.PrivateKey.CspKeyContainerInfo.UniqueKeyContainerName }},
@{n='Store'; e={ $MachineCert.PSParentPath }}
}
Subject Container Store
------- --------- -----
CN=Ryan-Win81-2014 f686aa...9dfa-7c3d5dc833ac Remote Desktop
CN=localhost fad662...9dfa-7c3d5dc833ac My
Note that you probably need admin/UAC elevation before you're allowed to read certain properties of certain certificates.
I can't say for sure that the "vagueness" is by design, but it wouldn't surprise me. Most people don't understand what X509 certificates are or what private keys are, nor do most people care, unfortunately. By doing it for you, Windows can at least hide the private keys in a relatively secure location deep within the file system, since if most users had to deal with private keys themselves, they'd just leave their private keys sitting around on their desktops.