(Node.js) Export a Private Key from an MS Storage Provider

Demonstrates how to export a private key from a Microsoft Storage Provider.

Note: This example requires Chilkat v9.5.0.83 or greater.

Install Chilkat for Node.js and Electron using npm at Chilkat npm packages for Node.js Chilkat npm packages for Electron on Windows, Linux, MacOSX, and ARM

var os = require('os');
if (os.platform() == 'win32') {  
    if (os.arch() == 'ia32') {
        var chilkat = require('@chilkat/ck-node21-win-ia32');
    } else {
        var chilkat = require('@chilkat/ck-node21-win64'); 
    }
} else if (os.platform() == 'linux') {
    if (os.arch() == 'arm') {
        var chilkat = require('@chilkat/ck-node21-arm');
    } else if (os.arch() == 'x86') {
        var chilkat = require('@chilkat/ck-node21-linux32');
    } else {
        var chilkat = require('@chilkat/ck-node21-linux64');
    }
} else if (os.platform() == 'darwin') {
    if (os.arch() == 'arm64') {
        var chilkat = require('@chilkat/ck-node21-mac-m1');
    } else {
        var chilkat = require('@chilkat/ck-node21-macosx');
    }
}

function chilkatExample() {

    // This example requires Chilkat v9.5.0.83 or greater.

    // We'll export a certificate's private key from the MS storage provider.
    // It is assumed the certificate + private key is already installed on the Windows system.
    // The export does not remove the key from the Windows storage provider.

    // First, let's get a certificate in one of the many ways we can do it.
    // (I ran certmgr.msc, opened a certificate, and noted it's thumbprint.)
    var cert = new chilkat.Cert();
    var success = cert.LoadByThumbprint("ea5a129c1919a52d238ee28d9f3a8f345b768388","hex");
    if (success == false) {
        console.log(cert.LastErrorText);
        return;
    }

    console.log("Found: " + cert.SubjectDN);

    // First export the private key the easy way.
    // privKey: PrivateKey
    var privKey = cert.ExportPrivateKey();
    if (cert.LastMethodSuccess == false) {
        console.log(cert.LastErrorText);
        return;
    }

    // OK.. we have the private key.  Do whatever we want with it..

    // -------------------------------------------------------------
    // Now let's export in a more roundabout way by getting information about the 
    // storage provider and key name and then we'll export completely independent
    // of the certificate.
    // 
    // Remember: The private key is not contained within the certificate.  An X.509 certificate
    // embeds the public key, but the counterpart private key is stored elsewhere, such
    // as in a .pfx/.p12, or as in this case, in the Windows "protected store", or perhaps on
    // a smartcard or hardware token.  (But a private key stored on a smartcard or token cannot
    // be exported.  It must remain on the hardware.)
    // 

    var storageProvider = cert.CspName;
    var keyName = cert.KeyContainerName;

    console.log("Information about the certificate's private key:");
    console.log("Storage Provider: " + storageProvider);
    console.log("Key Name: " + keyName);

    // Export using just the name of the storage provider and key.
    var keyCon = new chilkat.KeyContainer();
    var privKey2 = new chilkat.PrivateKey();
    var silentFlag = false;
    success = keyCon.ExportKey(keyName,storageProvider,silentFlag,privKey2);
    if (success == false) {
        console.log(keyCon.LastErrorText);
        return;
    }

    // OK.. we have the private key in privKey2.  Do whatever we want with it..
    // Perhaps we save as encrypted PKCS8 PEM.
    success = privKey2.SavePkcs8EncryptedPemFile("myPassword","qa_output/privKey2.pem");
    if (success == false) {
        console.log(privKey2.LastErrorText);
        return;
    }

    console.log("Success.");

}

chilkatExample();