I am attempting to set the KeySpec flag on an existing certificate for use in a SQL server encryption role. Current KeySpec is 0, and I need it to be a 1.
The way to do this is by first exporting the cert, its private key, and key usages into a .pfx file (with a password, regardless of what it claims). Then, utilizing certutil, run certutil -importpfx AT_KEYEXCHANGE.
This “works” in that it prompts for the password (which is typed in correctly), but it fails with this error message:
CertUtil: -importPFX command FAILED: 0x80090029 (-2146893783 NTE_NOT_SUPPORTED) CertUtil: The requested operation is not supported.
Unfortunately, there’s not much online that I could find – just this one post apparently:
https://anotherexchangeblog.wordpress.com/tag/importpfx-command-failed-0x80090029/
That one appears to indicate that it’s a problem with permissions on a directory located at C:ProgramDataMicrosoftCryptoRSAMachineKeys. Specifically, that “SYSTEM” had permissions on it, which he removed and got certutil working. However, my copy of that directory does not have SYSTEM with permissions – it looks to be the same as his picture.
Not a whole lot more to go on, and this certutil import method appears to be the only way to set KeySpec to 1. What can I do from here to allow me to import that key with the correct KeySpec flag?
Advertisement
Answer
I encountered this issue after generating my private key with Template = (No Template) CNG Key
To convert from CNG key back to Legacy Key you can use OpenSSL (https://www.google.com/search?q=Download+windows+OpenSSL) to re-encode the certificate
Export your current certificate to a passwordless pem
openssl pkcs12 -in mycert.pfx -out tmpmycert.pem -nodesConvert the pem file to a new pfx file with password:
openssl pkcs12 -export -out mycert2.pfx -in tmpmycert.pem
You can avoid the problem by generating your CSR using Template = (No Template) Legacy Key
Good Luck!