(Visual FoxPro) Export a Private Key from an MS Storage Provider

Demonstrates how to export a private key from a Microsoft Storage Provider.

Note: This example requires Chilkat v9.5.0.83 or greater.

Chilkat ActiveX Downloads ActiveX for 32-bit and 64-bit Windows

LOCAL loCert
LOCAL lnSuccess
LOCAL loPrivKey
LOCAL lcStorageProvider
LOCAL lcKeyName
LOCAL loKeyCon
LOCAL loPrivKey2
LOCAL lnSilentFlag

* This example requires Chilkat v9.5.0.83 or greater.

* We'll export a certificate's private key from the MS storage provider.
* It is assumed the certificate + private key is already installed on the Windows system.
* The export does not remove the key from the Windows storage provider.

* First, let's get a certificate in one of the many ways we can do it.
* (I ran certmgr.msc, opened a certificate, and noted it's thumbprint.)
* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.Cert')
loCert = CreateObject('Chilkat.Cert')
lnSuccess = loCert.LoadByThumbprint("ea5a129c1919a52d238ee28d9f3a8f345b768388","hex")
IF (lnSuccess = 0) THEN
    ? loCert.LastErrorText
    RELEASE loCert
    CANCEL
ENDIF

? "Found: " + loCert.SubjectDN

* First export the private key the easy way.
loPrivKey = loCert.ExportPrivateKey()
IF (loCert.LastMethodSuccess = 0) THEN
    ? loCert.LastErrorText
    RELEASE loCert
    CANCEL
ENDIF

* OK.. we have the private key.  Do whatever we want with it..

RELEASE loPrivKey

* -------------------------------------------------------------
* Now let's export in a more roundabout way by getting information about the 
* storage provider and key name and then we'll export completely independent
* of the certificate.
* 
* Remember: The private key is not contained within the certificate.  An X.509 certificate
* embeds the public key, but the counterpart private key is stored elsewhere, such
* as in a .pfx/.p12, or as in this case, in the Windows "protected store", or perhaps on
* a smartcard or hardware token.  (But a private key stored on a smartcard or token cannot
* be exported.  It must remain on the hardware.)
* 

lcStorageProvider = loCert.CspName
lcKeyName = loCert.KeyContainerName

? "Information about the certificate's private key:"
? "Storage Provider: " + lcStorageProvider
? "Key Name: " + lcKeyName

* Export using just the name of the storage provider and key.
* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.KeyContainer')
loKeyCon = CreateObject('Chilkat.KeyContainer')
* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.PrivateKey')
loPrivKey2 = CreateObject('Chilkat.PrivateKey')
lnSilentFlag = 0
lnSuccess = loKeyCon.ExportKey(lcKeyName,lcStorageProvider,lnSilentFlag,loPrivKey2)
IF (lnSuccess = 0) THEN
    ? loKeyCon.LastErrorText
    RELEASE loCert
    RELEASE loKeyCon
    RELEASE loPrivKey2
    CANCEL
ENDIF

* OK.. we have the private key in privKey2.  Do whatever we want with it..
* Perhaps we save as encrypted PKCS8 PEM.
lnSuccess = loPrivKey2.SavePkcs8EncryptedPemFile("myPassword","qa_output/privKey2.pem")
IF (lnSuccess = 0) THEN
    ? loPrivKey2.LastErrorText
    RELEASE loCert
    RELEASE loKeyCon
    RELEASE loPrivKey2
    CANCEL
ENDIF

? "Success."

RELEASE loCert
RELEASE loKeyCon
RELEASE loPrivKey2