I am trying to use certificates and private keys on embedded systems that were generated from Microsoft Active Directory Certificate Services . NDES and SCEP are currently out of scope so it will need to be semi-manual.
I am using the Microsoft web tool on our AD CA server at https://server/certsrv . I am able to go through and generate a response without a CSR, and export the private key with the cert. The response is a page that asks me to "Install This certificate" or "Save the response".
If I run the "Install This Certificate" option, the Windows Certmgr application shows that I have imported the certificate and I have the Private Key. This can then be exported as a PKCS#12 file, which can be used or converted to PEM. However, If I use the "Save the Response" option and store the file as a p7b (as indicated by certutil when examining the response file), and then I use the p7b file to import the certificates, there is not private key available. This is consistent, as I would not expect a PKCS#7 file to store private keys.
The PKCS#7 file format doesn't seem to support private keys and OpenSSL doesn't seem to support extracting private keys from a PKCS#7 file. Is there a way to use the certsrv web tool and obtain both the cert and the private key without having to "Install This Certificate" in Windows? Also, WTF is going on that allows MS to install the private keys that I can't seem to obtain? I've looked at the scripts in the file https://dakota.main.lab/certsrv/certfnsh.asp and they seem to be using the same pkcs#7 data as is presented in the "save response" output.
Thanks in advance.