How to generate a stronger EFS Certificate for file encryption

Question

If I use the built-in certificate creation tool in Windows 10, for EFS certificates, I can generate certificates for my user account, but they are created with a SHA-1 hashing algorithm. I tried searching online but couldn't find anything.

Can I use the built-in windows certificate creation tool to create a self-signed certificate that uses a SHA-256 hashing algorithm? I want to use the certificate to encrypt files on my HDD.

Answer 1

Hello @Jorg Smash ,

Thank you for posting here.

You can try standalone CA, since Standalone CA do not require Active Directory domain.

Difference between Microsoft ADCS Standalone CA and Enterprise CA
https://serverfault.com/questions/826444/difference-between-microsoft-adcs-standalone-ca-and-enterprise-ca/826624

Please note: Information posted in the given link is hosted by a third party. Microsoft does not guarantee the accuracy and effectiveness of information.

Hope the information is helpful.

Should you have any question or concern, please feel free to let us know.

Best Regards,
Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.

Answer 2

This article is a bit old but I might have some useful info to this.

Your issue gave me an idea and I was playing around with certificates. Using openssl I generated much more sophisticated key pairs and I was able to use that key to encrypt folders/files. To make it more secure, I uploaded the private keys and certificates to my Yubikey 5C and whenever I had to get access to the encrypted files, the hardware key must have been inserted (and also touched in my case).

I can put some details here if anyone is interested in it.