Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This is may sounds very strange but let me explain a situation:
I was using my PKI Private Key installed at Windows Certificate Storage I get token, so I decided to load them to token and delete them from windows' storage. So far, so good.

But now, when I use token key re-appear in Windows Certificate Storage (that is normal as you can see also certificates from smartcards here). But I can export private key! And this is definitely wrong.

I tried to use token only on different machine (where private key was never really stored in storage) and private key is not exportable.

Have you any idea how this could happened? And how to really delete private key from storage? Or why they re-stored, somehow?

share|improve this question
up vote 0 down vote accepted

I am just "WOW" - I would not call this secure at any way - according to private keys are not deleted and stay in system WITHOUT any information about this, I used tried to used app in attached link, but it does not work, however I was able to identify private keys with hexa editor in path C:\Users\[USERNAME]\AppData\Roaming\Microsoft\Crypto\RSA\[UID] and delete them permanently from system. I am still kind of shocked this is not a bug but feature.

If you have a certificate installed on HD (i.e. using the MS Enhaced CSP), then, following Microsoft, you can remove it using IExplorer, on the Tools menu, you click Internet Options, then you click the* Content* tab, and then click Remove. This is a well known action described in

Doing this, you effectively remove the certificate, but THE PRIVATE KEY REMAINS IN THE HD. You can find a lot of scenarios where this can be a problem. Suppose you go to a friend's home, you install a pkcs12 file containing your certificate and private key with "Medium" security level (the default), then you use it, and when you finishes your work, you remove the certificate (but NO the private key). Then your friend takes your certificate (is a public document) and installs it, having your private key working for him.

The program cleancapi deletes the private keys that are not used by any certificate. Source code: Precompiled version:

share|improve this answer
It's not soo much of a bug and inded a feature. You need your private key even when the corresponding public certificate has been deleted or made invalid or it has expired. For example, otherwise you couldn't decrypt any data encrypted via the certificate. A certificate is to be viewed as something totally separated from a private key (for example you collect many certificates of thirs parties, of course without their private key). - Installinmg one's private key on a foreign machine, that is the real security gap (even if you deleted it, his box might long have copied it in the background). – Hagen von Eitzen Aug 15 '14 at 9:17

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.