|
|
You're in the
dotnet security
group:X.509 Certificate store - getting - creating certs
dotnet security:
in the October issue of the MSDN Magazine. One of the things that the sample application "Picture Viewer" does is to attempt to get a X.509 Cetificate from the Certificate Store. <code> private X509Certificate2 GetCertificate() { X509Store store = new X509Store(StoreLocation.CurrentUser); store.Open(OpenFlags.ReadOnly); X509Certificate2Collection matches; matches = store.Certificates.Find(X509FindType.FindBySubjectName, "PictureView", false); return (matches.Count > 0) ? matches[0] : null ; } </code> I have this running on a brand new RC2 build of Vista and of course have no certificates. Therefore it finds no certificates. Couple of questions - 1) Can I put a Certificate on this machine or do I have to install it on a Server class machine? 2) How do I get / create a X.509 cert and install on a machine? I have been looking into the CryotAPI to get a better idea of what is trying to take place but have not yet answered the above questions. If anyone has information / resources that will help me gain a better understanding of security with regard to WCF / .Net 3.0 that they can point me at it will be greatly appreciated. -- Thank you,
[quoted text, click to view]
"John A" <i-code4food@newsgroups.nospam> wrote: > 2) How do I get / create a X.509 cert and install on a machine? I've been doing quite a bit of .Net 3.0 these days, and came across this same problem. I had a real need to be able to generate X.509 certificates in code. After looking around for ages for code samples to do this, I gave up and did it myself. My solution isn't really pretty, but it does get the job done. http://www.coversant.net/dotnetnuke/Default.aspx?tabid=88&EntryID=21 The code in there creates a self-signed X.509 Certificate, writes it to a file, then loads that file into an X509Certificate2 class. I'm essentially shelling out to MakeCert.exe for the certificate generation, as I couldn't figure out a good way to do this in purely managed code. Note that the code to move this new certificate into a Certificate Store is really easy, as there are classes in the .Net framework that will do this. -- Chris Mullins, MCSD.NET, MCPD:Enterprise http://www.coversant.net/blogs/cmullins
Thanks Chris. When I run the following I get an error any ideas why?
C:\Program Files\Microsoft Visual Studio 8\Common7\Tools\Bin>makecert -r -pe -n "CN=TestUser" -ss my -sr currentuser -sky exchange .\TestUser.cer Error: WriteFile failed => 0x5 (5) Failed -- Thank you, John [quoted text, click to view] "Chris Mullins" wrote:
> "John A" <i-code4food@newsgroups.nospam> wrote: > > > 2) How do I get / create a X.509 cert and install on a machine? > > I've been doing quite a bit of .Net 3.0 these days, and came across this > same problem. I had a real need to be able to generate X.509 certificates in > code. > > After looking around for ages for code samples to do this, I gave up and did > it myself. My solution isn't really pretty, but it does get the job done. > > http://www.coversant.net/dotnetnuke/Default.aspx?tabid=88&EntryID=21 > > The code in there creates a self-signed X.509 Certificate, writes it to a > file, then loads that file into an X509Certificate2 class. I'm essentially > shelling out to MakeCert.exe for the certificate generation, as I couldn't > figure out a good way to do this in purely managed code. > > Note that the code to move this new certificate into a Certificate Store is > really easy, as there are classes in the .Net framework that will do this. > > -- > Chris Mullins, MCSD.NET, MCPD:Enterprise > http://www.coversant.net/blogs/cmullins > >
Only the obvious thoughts:
1 - Are you running as an Administator? If not, do you have rights to write to the directory? 2 - Is there already a "TestUser.cer" file in that directory? You can probably eliminate a number of those flags - for instance, the default is the "CurrentUser" store, so you don't need "-sr curretnuser". You could trying playing with the flags and see if anything changes. -- Chris Mullins [quoted text, click to view] "John A" <i-code4food@newsgroups.nospam> wrote in message news:C74F094B-02CA-49CD-8307-98A817C61846@microsoft.com... > Thanks Chris. When I run the following I get an error any ideas why? > > C:\Program Files\Microsoft Visual Studio > 8\Common7\Tools\Bin>makecert -r -pe > -n "CN=TestUser" -ss my -sr currentuser -sky exchange .\TestUser.cer > Error: WriteFile failed => 0x5 (5) > Failed > > > -- > Thank you, > John > > > "Chris Mullins" wrote: > >> "John A" <i-code4food@newsgroups.nospam> wrote: >> >> > 2) How do I get / create a X.509 cert and install on a machine? >> >> I've been doing quite a bit of .Net 3.0 these days, and came across this >> same problem. I had a real need to be able to generate X.509 certificates >> in >> code. >> >> After looking around for ages for code samples to do this, I gave up and >> did >> it myself. My solution isn't really pretty, but it does get the job done. >> >> http://www.coversant.net/dotnetnuke/Default.aspx?tabid=88&EntryID=21 >> >> The code in there creates a self-signed X.509 Certificate, writes it to a >> file, then loads that file into an X509Certificate2 class. I'm >> essentially >> shelling out to MakeCert.exe for the certificate generation, as I >> couldn't >> figure out a good way to do this in purely managed code. >> >> Note that the code to move this new certificate into a Certificate Store >> is >> really easy, as there are classes in the .Net framework that will do >> this. >> >> -- >> Chris Mullins, MCSD.NET, MCPD:Enterprise >> http://www.coversant.net/blogs/cmullins >> >> >>
Yes I am Administrator.
I tried to create a cert with another name and received the same error. I also did a search of the entire hard drive and no .cer files to be found. I am running windows vista not sure if that might make things different. I will play around with the flags later but right now I need to go to my paying job, I'll ask a co-worker there. Thanks again for all your help. -- Thank you, John [quoted text, click to view] "Chris Mullins" wrote:
> Only the obvious thoughts: > 1 - Are you running as an Administator? If not, do you have rights to write > to the directory? > 2 - Is there already a "TestUser.cer" file in that directory? > > You can probably eliminate a number of those flags - for instance, the > default is the "CurrentUser" store, so you don't need "-sr curretnuser". You > could trying playing with the flags and see if anything changes. > > > -- > Chris Mullins > > "John A" <i-code4food@newsgroups.nospam> wrote in message > news:C74F094B-02CA-49CD-8307-98A817C61846@microsoft.com... > > Thanks Chris. When I run the following I get an error any ideas why? > > > > C:\Program Files\Microsoft Visual Studio > > 8\Common7\Tools\Bin>makecert -r -pe > > -n "CN=TestUser" -ss my -sr currentuser -sky exchange .\TestUser.cer > > Error: WriteFile failed => 0x5 (5) > > Failed > > > > > > -- > > Thank you, > > John > > > > > > "Chris Mullins" wrote: > > > >> "John A" <i-code4food@newsgroups.nospam> wrote: > >> > >> > 2) How do I get / create a X.509 cert and install on a machine? > >> > >> I've been doing quite a bit of .Net 3.0 these days, and came across this > >> same problem. I had a real need to be able to generate X.509 certificates > >> in > >> code. > >> > >> After looking around for ages for code samples to do this, I gave up and > >> did > >> it myself. My solution isn't really pretty, but it does get the job done. > >> > >> http://www.coversant.net/dotnetnuke/Default.aspx?tabid=88&EntryID=21 > >> > >> The code in there creates a self-signed X.509 Certificate, writes it to a > >> file, then loads that file into an X509Certificate2 class. I'm > >> essentially > >> shelling out to MakeCert.exe for the certificate generation, as I > >> couldn't > >> figure out a good way to do this in purely managed code. > >> > >> Note that the code to move this new certificate into a Certificate Store > >> is > >> really easy, as there are classes in the .Net framework that will do > >> this. > >> > >> -- > >> Chris Mullins, MCSD.NET, MCPD:Enterprise > >> http://www.coversant.net/blogs/cmullins > >> > >> > >> > >
Ah. Vista.
Try creating this certificate in your personal documents directory. IIRC, Vista has all sorts of prohibitions against file writes to Program Files directories from applications other than installers. Simply being logged in as an administrator isn't enough to bypass this, although explicitly running the command prompt "Run as Administrator" may be sufficient. -- Chris Mullins [quoted text, click to view] "John A" <i-code4food@newsgroups.nospam> wrote: > Yes I am Administrator. > > I tried to create a cert with another name and received the same error. I > also did a search of the entire hard drive and no .cer files to be found. > I > am running windows vista not sure if that might make things different. I > will play around with the flags later but right now I need to go to my > paying > job, I'll ask a co-worker there. > > Thanks again for all your help. > > -- > Thank you, > John > > > "Chris Mullins" wrote: > >> Only the obvious thoughts: >> 1 - Are you running as an Administator? If not, do you have rights to >> write >> to the directory? >> 2 - Is there already a "TestUser.cer" file in that directory? >> >> You can probably eliminate a number of those flags - for instance, the >> default is the "CurrentUser" store, so you don't need "-sr curretnuser". >> You >> could trying playing with the flags and see if anything changes. >> >> >> -- >> Chris Mullins >> >> "John A" <i-code4food@newsgroups.nospam> wrote in message >> news:C74F094B-02CA-49CD-8307-98A817C61846@microsoft.com... >> > Thanks Chris. When I run the following I get an error any ideas why? >> > >> > C:\Program Files\Microsoft Visual Studio >> > 8\Common7\Tools\Bin>makecert -r -pe >> > -n "CN=TestUser" -ss my -sr currentuser -sky exchange .\TestUser.cer >> > Error: WriteFile failed => 0x5 (5) >> > Failed >> > >> > >> > -- >> > Thank you, >> > John >> > >> > >> > "Chris Mullins" wrote: >> > >> >> "John A" <i-code4food@newsgroups.nospam> wrote: >> >> >> >> > 2) How do I get / create a X.509 cert and install on a machine? >> >> >> >> I've been doing quite a bit of .Net 3.0 these days, and came across >> >> this >> >> same problem. I had a real need to be able to generate X.509 >> >> certificates >> >> in >> >> code. >> >> >> >> After looking around for ages for code samples to do this, I gave up >> >> and >> >> did >> >> it myself. My solution isn't really pretty, but it does get the job >> >> done. >> >> >> >> http://www.coversant.net/dotnetnuke/Default.aspx?tabid=88&EntryID=21 >> >> >> >> The code in there creates a self-signed X.509 Certificate, writes it >> >> to a >> >> file, then loads that file into an X509Certificate2 class. I'm >> >> essentially >> >> shelling out to MakeCert.exe for the certificate generation, as I >> >> couldn't >> >> figure out a good way to do this in purely managed code. >> >> >> >> Note that the code to move this new certificate into a Certificate >> >> Store >> >> is >> >> really easy, as there are classes in the .Net framework that will do >> >> this. >> >> >> >> -- >> >> Chris Mullins, MCSD.NET, MCPD:Enterprise >> >> http://www.coversant.net/blogs/cmullins >> >> >> >> >> >> >> >> >>
Aha, thats was it. I am new to Vista and therefore mostly unfamiliar with
its vagaries. -- Thank you, John [quoted text, click to view] "Chris Mullins" wrote:
> Ah. Vista. > > Try creating this certificate in your personal documents directory. IIRC, > Vista has all sorts of prohibitions against file writes to Program Files > directories from applications other than installers. > > Simply being logged in as an administrator isn't enough to bypass this, > although explicitly running the command prompt "Run as Administrator" may be > sufficient. > > -- > Chris Mullins > > "John A" <i-code4food@newsgroups.nospam> wrote: > > Yes I am Administrator. > > > > I tried to create a cert with another name and received the same error. I > > also did a search of the entire hard drive and no .cer files to be found. > > I > > am running windows vista not sure if that might make things different. I > > will play around with the flags later but right now I need to go to my > > paying > > job, I'll ask a co-worker there. > > > > Thanks again for all your help. > > > > -- > > Thank you, > > John > > > > > > "Chris Mullins" wrote: > > > >> Only the obvious thoughts: > >> 1 - Are you running as an Administator? If not, do you have rights to > >> write > >> to the directory? > >> 2 - Is there already a "TestUser.cer" file in that directory? > >> > >> You can probably eliminate a number of those flags - for instance, the > >> default is the "CurrentUser" store, so you don't need "-sr curretnuser". > >> You > >> could trying playing with the flags and see if anything changes. > >> > >> > >> -- > >> Chris Mullins > >> > >> "John A" <i-code4food@newsgroups.nospam> wrote in message > >> news:C74F094B-02CA-49CD-8307-98A817C61846@microsoft.com... > >> > Thanks Chris. When I run the following I get an error any ideas why? > >> > > >> > C:\Program Files\Microsoft Visual Studio > >> > 8\Common7\Tools\Bin>makecert -r -pe > >> > -n "CN=TestUser" -ss my -sr currentuser -sky exchange .\TestUser.cer > >> > Error: WriteFile failed => 0x5 (5) > >> > Failed > >> > > >> > > >> > -- > >> > Thank you, > >> > John > >> > > >> > > >> > "Chris Mullins" wrote: > >> > > >> >> "John A" <i-code4food@newsgroups.nospam> wrote: > >> >> > >> >> > 2) How do I get / create a X.509 cert and install on a machine? > >> >> > >> >> I've been doing quite a bit of .Net 3.0 these days, and came across > >> >> this > >> >> same problem. I had a real need to be able to generate X.509 > >> >> certificates > >> >> in > >> >> code. > >> >> > >> >> After looking around for ages for code samples to do this, I gave up > >> >> and > >> >> did > >> >> it myself. My solution isn't really pretty, but it does get the job > >> >> done. > >> >> > >> >> http://www.coversant.net/dotnetnuke/Default.aspx?tabid=88&EntryID=21 > >> >> > >> >> The code in there creates a self-signed X.509 Certificate, writes it > >> >> to a > >> >> file, then loads that file into an X509Certificate2 class. I'm > >> >> essentially > >> >> shelling out to MakeCert.exe for the certificate generation, as I > >> >> couldn't > >> >> figure out a good way to do this in purely managed code. > >> >> > >> >> Note that the code to move this new certificate into a Certificate > >> >> Store > >> >> is > >> >> really easy, as there are classes in the .Net framework that will do > >> >> this. > >> >> > >> >> -- > >> >> Chris Mullins, MCSD.NET, MCPD:Enterprise > >> >> http://www.coversant.net/blogs/cmullins > >> >> > >> >> > >> >> > >> > >> > >> > >
Don't see what you're looking for? Try a search.
|
June 2004
July 2004
August 2004
September 2004
October 2004
November 2004
December 2004
January 2005
February 2005
March 2005
April 2005
May 2005
June 2005
July 2005
August 2005
September 2005
October 2005
November 2005
December 2005
January 2006
February 2006
March 2006
April 2006
May 2006
June 2006
July 2006
August 2006
September 2006
October 2006
November 2006
December 2006
January 2007
February 2007
March 2007
April 2007
May 2007
June 2007
July 2007
August 2007
September 2007
October 2007
November 2007
| home · blog · groups | Questions? Comments? Contact the dn |