windows - How to grant an account permissions to access a certificate? -


i have certificate in msmq service personal store , need grant network service permissions access certificate.

the way know of using certutil.exe on win2008/7 so:

certutil -service -service -repairstore msmq\my "" d:pai(a;;ga;;;ba)(a;;ga;;;sy)(a;;gr;;;ns) 

(thanks http://blogs.msdn.com/b/gautamm/archive/2010/10/26/https-messaging-with-client-side-certificate-fails-with-iis-error-403.aspx)

however, certutil on win2003/xp not recognize -service parameter, no good.

my question how can in way works both win2003/xp , win2008/7?

i need non interactive approach (command line utility, script, com/.net/win32 api).

if need set acl rights on certificate's private key (which linked page suggests), posted answer here on how found that.

open x509store , current certificate in hand, , set acl on private key.

you can use sid of account needing access (or use well-known sid s-1-5-20 if know it's network service):

ntaccount nt = new ntaccount("nt_authority", "networkservice"); securityidentifier sid = (securityidentifier)nt.translate(typeof(securityidentifier)); 

my other answer has code sets acl. (caveat: i've run on windows server 2003 not xp.)


Comments

Popular posts from this blog

python - Scipy curvefit RuntimeError:Optimal parameters not found: Number of calls to function has reached maxfev = 1000 -

c# - How to add a new treeview at the selected node? -

java - netbeans "Please wait - classpath scanning in progress..." -