rustls / rustls-cng

Windows CNG bridge for rustls

Windows CNG bridge for rustls

This crate allows you to use the Windows CNG private keys together with rustls for both the client and server sides of the TLS channel.

Rationale: In many situations, it is required to use non-exportable private certificate chains from the Windows certificate store instead of the external PKCS8 file. rustls-cng can use such chains in the rustls context.

Supported key/certificate types: RSA, ECDSA/ECDH. Supported elliptic curves: secp256r1 (prime256v1), secp384r1.

Documentation

Documentation is available here.

Usage

The central struct to use in rustls-cng is CngSigningKey, which can be constructed from the low-level NCryptKey handle. The instance of CngSigningKey can then be used in rustls in the custom ResolvesServerCert or ResolvesClientCert implementation.

See the examples directory for usage examples.

License

Licensed under the MIT or Apache licenses (LICENSE-MIT or LICENSE-APACHE)

rustls-cng's Issues

Is RSA 4096bit supported?

Hello.
Any ideas why I could be getting "Error code 80090016" when trying to access an RSA-4096bit certificate from store?
The certificate from the pfx file before imported, is being read and used like a charm.

And, would an ed25519 certificate be supported?
At the moment I cannot even import it in store though, but the pfx returns the same error code as above.
Thank you.

UPDATE: Interesting... While the RSA-2048bit imported certificate has non-exportable key, it works. The 4096bit does not. It worked with nothing checked or, of course, with exportable. It works with non-exportable key if run as administrator.

What can you make out of this?
Could it be that the non-exportable 4K key is stored in the TPM, which requires administrative rights to be accessed?