Cryptography – How Windows MachineKey Container File Names Are Derived

access-control-listcertificatecryptographywindows

In the C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys directory there's an enumeration of Key Containers. The naming convention is <uniqueGUID>_<staticGUID> and I presume the <staticGUID> to be a machine identifier. Ultimately I want to be able to pair the Key Container with it's respective cert so I can target specific Key Files for ACL's. To do that I need to know how the <uniqueGUID> is derived and how it relates to certificates.

The Microsoft resources I've checked so far haven't elucidated an answer, but are great for reference:

Understanding Machine-Level and User-Level RSA Key Containers (IIS reference)

How to: Change the Security Permissions for the MachineKeys Directory

Best Answer

To solve your problem of finding which certificate goes with which key file for the purpose of modifying file system ACLs on the private key files, use this:

PS C:\Users\Ryan> $Cert = Get-Item Cert:\LocalMachine\My\2F6CB7D56BAA752BCCC0829DD829C0E2662FA1C6    

PS C:\Users\Ryan> $Cert.PrivateKey.CspKeyContainerInfo.UniqueKeyContainerName

fad662b360941f26a1193357aab3c12d_03f917b5-cb8b-45bd-b884-41c139a66ff7

The file naming convention is x_y, where x is a random GUID to uniquely identify the key, and y is the machine GUID found at HKLM\SOFTWARE\Microsoft\Cryptography.

Some of these unique identifiers are well-known, such as some of these IIS ones:

6de9cb26d2b98c01ec4e9e8b34824aa2_GUID      iisConfigurationKey

d6d986f09a1ee04e24c949879fdb506c_GUID      NetFrameworkConfigurationKey

76944fb33636aeddb9590521c2e8815a_GUID      iisWasKey

But others are generated randomly.

Note that this information only applies to "Local Computer" or "Machine" certificates/keys. User certificates are stored in the corresponding user-specific locations on the file system and registry.

Related Topic