14

Using the certmgr.msc utility, I can access the windows cert store, but I still can't figure out where Windows stores the private keys.

For example for a given certificate, Windows tells me that there is a private key associated with this certificate. But where I can I physically find it ?

1 Answer 1

17

The keys are stored via Microsoft's Cryptography API: Next Generation (CNG).

Storage locations:

  • User private:
    %APPDATA%\Microsoft\Crypto\Keys
  • Local system private:
    %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\SystemKeys
  • Local service private:
    %WINDIR%\ServiceProfiles\LocalService
  • Network service private:
    %WINDIR%\ServiceProfiles\NetworkService
  • Shared private:
    %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\Keys

Description:

CNG provides a model for private key storage that allows adapting to the current and future demands of creating applications that use cryptography features such as public or private key encryption, as well as the demands of the storage of key material. The key storage router is the central routine in this model and is implemented in Ncrypt.dll. An application accesses the key storage providers (KSPs) on the system through the key storage router, which conceals details, such as key isolation, from both the application and the storage provider itself. The following illustration shows the design and function of the CNG key isolation architecture.
Key Storage Architecture
Source

Note:

As noted by Tim G, the keys are not readable at file level because they are encrypted in the process of storing them via the CNG API.

2
  • 4
    These key locations are correct, but I have one point of emphasis/clarity: Windows Key isolation services obscure the keys, so they are not readable at the user or Administrator level from within the operating system as-is. (They are visible as files in Explorer, but you couldn't dump their true contents in a hex viewer or as ugly ASCII in notepad -- it would still be ugly ASCII, just not the true representation like in Unixoid systems.)
    – Tim G
    Apr 5, 2016 at 10:18
  • 2
    @TimG Can you point me at any documentation which describes that obscuration? (I realize it's a bit late, but I can hope...) Aug 3, 2018 at 14:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .