Is it possible to request a certificate for an ECC key pair with private key archival?
I'm using Windows Server 2012 with Certificate Services enabled. I'd like to generate ECC encryption certificates with key archival, in order to later recover the private key. It works perfectly with RSA key pairs.
I followed the documentation to format CMC requests: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-wcce/446a0fca-7f27-4436-965d-191635518466
When sending a CMC request enveloping an ECC private key, the request fails on CA side with error "Invalid Signature", but no details about what signature is failing. Nothing more in the event viewer.
The exact same CMC request succeeds when enveloping a RSA private key.
The ASN1 structure of the request looks good to me as far as I know. I attach the base64 encoded request: test_cmc_request_ecc.txt
The certificate template is configured this way:
I tested on Windows Server 2016 and 2019 without success.
By the way, I was able to setup a certificate template and successfully generated a certificate with an archived ECC key pair using the 'Certificates' snap-in of MMC, but I cannot get the request that the MMC generates for comparison.
Does AD Certificate Services support CMC requests with ECC private key?
Am I missing an important configuration that would be required for ECC whereas it works for RSA?
Is there any sample that would demonstrate how to format a working request?
Thank you for your help.
1 answer
Sort by: Most helpful
-
Deleted
This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Comments have been turned off. Learn more