|
Posted by jwgoerlich on September 20, 2007, 7:42 am
Please log in for more thread options
Does the "Network Service" account have read permissions to the
MachineKeys folder? This is located under All Users Profile
\Application Data\Microsoft\Crypto\RSA.
J Wolfgang Goerlich
> I have a certificate I'd like to be able to use from my ISAPI Extension,
> which runns as "Network Service". I've seen things for giving
> permission to the certificate itself via WinHttpCertCfg, but I'm unable
> to open the local machine certificate store _at all_. The C++ call
>
> HCERTSTORE hSystemStore = CertOpenStore(CERT_STORE_PROV_SYSTEM, 0,
> NULL, CERT_SYSTEM_STORE_LOCAL_MACHINE, L"MY");
>
> returns NULL, and GetLastError() gives 5 (Access Denied). I've seen
> people asking similar[1] questions[2], but never getting a response.
> Pages such as this[3] specifically reference grantin access to Network
> Service, so it has to be possible.
>
> If I change the application pool to run as "Local System", then opening
> the store & getting the cert works, but I'd like to avoid the privilege
> escalation if possible. How do I get into the Certificate Store as
> Network Service?
>
> Thanks
> Jason
>
> [1]http://www.eggheadcafe.com/forumarchives/securitycrypto/Jul2005/post2...
> [2]http://www.derkeiler.com/Newsgroups/microsoft.public.dotnet.framework...
> [3]http://msdn2.microsoft.com/en-us/library/aa302408.aspx
| 
XML Sitemap