Is it possible to request a certificate for an ECC key pair with private key archival?

Moreira, Raphaël 5 Reputation points
2023-04-03T08:11:26.0533333+00:00

I'm using Windows Server 2012 with Certificate Services enabled. I'd like to generate ECC encryption certificates with key archival, in order to later recover the private key. It works perfectly with RSA key pairs.

I followed the documentation to format CMC requests: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-wcce/446a0fca-7f27-4436-965d-191635518466

When sending a CMC request enveloping an ECC private key, the request fails on CA side with error "Invalid Signature", but no details about what signature is failing. Nothing more in the event viewer.

User's image

The exact same CMC request succeeds when enveloping a RSA private key.

The ASN1 structure of the request looks good to me as far as I know. I attach the base64 encoded request: test_cmc_request_ecc.txt

The certificate template is configured this way:
User's image

User's image

I tested on Windows Server 2016 and 2019 without success.

By the way, I was able to setup a certificate template and successfully generated a certificate with an archived ECC key pair using the 'Certificates' snap-in of MMC, but I cannot get the request that the MMC generates for comparison.

Does AD Certificate Services support CMC requests with ECC private key?

Am I missing an important configuration that would be required for ECC whereas it works for RSA?

Is there any sample that would demonstrate how to format a working request?

Thank you for your help.

Windows
Windows
A family of Microsoft operating systems that run across personal computers, tablets, laptops, phones, internet of things devices, self-contained mixed reality headsets, large collaboration screens, and other devices.
5,822 questions
Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
13,726 questions
0 comments No comments
{count} vote

1 answer

Sort by: Most helpful
  1. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.


    Comments have been turned off. Learn more

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.