How to import a certificate (pfx) with a private key in Windows XP

Question

I tried the whole day just to import a certificate in Windows XP, but I always failed. I did following:

1. Create the certificate with a private key (no password):
   

   makecert -sr LocalMachine -ss My -pe -sky exchange -n "CN=TestCert" -a sha1 -sv TestCert.pvk TestCert.cer

2. Then put the certificate and private key together into a pfx file:
   

   pvk2pfx.exe -pvk TestCert.pvk -spc TestCert.cer -pfx TestCert.pfx

3. Import the pfx file with a command-line tool (German system):
   

   winhttpcertcfg.exe -I TestCert.pfx -a NT-AUTORITÄT\NETZWERKDInternet ExplorerNST -c LOCAL_MACHINE\My
   Error:  Unable to import contents of PFX file.
       Please make sure the filename and path,
       as well as the password, are correct.

   Hint: "NT-AUTORITÄT\NETZWERKDInternet ExplorerNST" --> "NT-AUTHORITY\NETWORKSERVICE"
   Filename is OK, and the password was not set. Even if I set the password (e.g. "MyPassword") in Step 1 and type at the end of step 3:
   

   ... -p MyPassword

I got the same error. Then I tried to import in the certificate console (mmc with certificate snap-in). There I got following error: "Der private Schlüssel, den Sie importieren, erfordert möglicherweise einen Dienstanbieter, der nicht installiert ist." --> "The imported private key may require a service-supplier which is not installed". But the Microsoft Crypto-Service is up and running.

What else can I do?
On Windows Vista and Windows 7, I got this running without these problems.
I need this certificate to run a WCF service.

Answer 1

Meanwhile, I found the reason for the Problem.

Some days before trying to import certificates with private keys, I changed the directory access rights of the location where the private keys are stored. I did following:

cacls "C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft\Crypto\RSA\MachineKeys" /E /G "NT-AUTORITÄT\NETZWERKDIENST":R

After that I was no longer able to import certificates containing private keys. As soon as I revoked this particular access right the import of certificates worked well.

I do not understand, why adding an access right will result in practically less access rights.

However, I hope this may help someone of you running into same problem.