CertMgr Configuration

This settings specified the comment to use when calling SaveCertificate. This can only be used when CertificateOutputFormat is set to a value other than the default value. When CertificateOutputFormat is set to "SSH2PublicKey" the value of this setting should be the full header. For instance: "Comment: My Comment".

This property controls the size of the following arrays:

• CertCustomExtensionCritical[i];
• CertCustomExtensionOID[i];
• CertCustomExtensionValue[i];

The array indices start at 0 and end at CertExtensionCount-1.

Whether or not the certificate extension at index 'i' is defined as critical.

Valid array indices are from 0 to CertCustomExtensionCount - 1.

The ASN.1 Object-Identifier (OID) that defines the certificate extension at index 'i'.

Valid array indices are from 0 to CertCustomExtensionCount - 1.

The raw value of this certificate extension (as a byte string). This value is encoded according to the extension's ASN.1 specification.

Valid array indices are from 0 to CertCustomExtensionCount - 1.

By default when SaveCertificate is called the certificate will be written in a PEM format. The format may be changed by setting CertificateOutputFormat to one of the following values:

-----BEGIN CERTIFICATE-----
MIIBkTCB+6ADAgECAgEBMA0GCSqGSIb3DQEBBQUAMA4xDDAKBgNVBAMTAzEwMDAgFw0wNzAx
...
Pg49SpQ+HcUibIpum2O0hmnySH7BPGfXD8Lu
-----END CERTIFICATE-----

---- BEGIN SSH2 PUBLIC KEY ----
AAAAB3NzaC1yc2EAAAADAQABAAAAgQD5/STHUd7YkN1JyoyYnUvCf+Fyx1+ZleBJxvwDcm3y
...
6bVPTODELil1PVWJDlfdwoLZZKY2ACFHzxBqaOlYv1rbd2JIYAuqGca2ow==
---- END SSH2 PUBLIC KEY ----

ssh-rsa AAAAB3NzaC1y...

<X509Data><X509Certificate>MIIBkTCB+6ADAgECAgEBMA0GCSqGSIb3DQEBBQUAMA4xDDAKBgNVBAMTAzEwMDAgFw0wNzAx
...
Pg49SpQ+HcUibIpum2O0hmnySH7BPGfXD8Lu</X509Certificate></X509Data>

When CreateCertificate creates a new certificate and associated key, or when CreateKey creates a key, this setting determines the length of the new public key (in bits). The default value is 1024.

When CreateCertificate creates a new certificate and associated key, or when CreateKey creates a key, this setting determines the type of key generated: 1 for key exchange (encryption) keys, and 2 for digital signature keys. The default value is 1.

When CreateCertificate creates a new certificate and associated key, this setting determines the public key algorithm of the generated keys. Valid values are:

• RSA (default)
• DSA
• ECDSA_P256
• ECDSA_P384
• ECDSA_P521
• Ed25519
• Ed448

When CreateCertificate or IssueCertificate creates a new certificate, the signature algorithm used is specified by this setting. Possible values are:

• MD2
• MD5
• SHA1
• SHA256 (default)
• SHA384
• SHA512

This configuration setting determines the duration in days that a newly created certificate remains valid. The certificate becomes valid as soon as it is created, unless CertValidityOffset is set. The duration is not changed if CertValidityOffset is set; the certificate will still expire CertValidityTime days after the validity period begins. The default value is 365 days.

This configuration setting can be used to change when a newly created certificate becomes valid. By default, the certificate is valid as soon as it is created. Set CertValidityOffset to the number of days that this starting period should be offset from the current day. This setting also accepts negative values for back-dating the validity of a certificate. The default value is 0.

The name of the Cryptographic Service Provider used to provide access to certificate signing operations.

Set this configuration setting to a comma separated list of OID's of any extensions already present in the CSR that should be ignored when the CSR is signed.

For example if the SAN's in a CSR should be ignored the below code would work:

CertMgr1->Config("CSRIgnoredExtensions=2.5.29.17");

This setting holds the certificate data that is exported when ExportCertificate is called with an empty CertFile parameter. If ExportFormat is set to "PFX" this setting holds the hex encoded PFX file data. If ExportFormat is set to any other value this holds the raw certificate content (not encoded).

By default when ExportCertificate is called the certificate will be written as a PFX file. The format of the exported certificate may be changed by setting ExportFormat to one of the following values:

-----BEGIN RSA PRIVATE KEY-----
MIICWwIBAAKBgQD5/STHUd7YkN1JyoyYnUvCf+Fyx1+ZleBJxvwDcm3yaZ98bvry
...
91y8ydb3mQ9l1hZudo2sj8tHnvEgph0r7B8hMM6Qaw==
-----END RSA PRIVATE KEY-----

-----BEGIN PRIVATE KEY-----
MIICdQIBADANBgkqhkiG9w0BAQEFAASCAl8wggJbAgEAAoGBAPn9JMdR3tiQ3UnK
...
HSvsHyEwzpBr
-----END PRIVATE KEY-----

-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAlwAAAAdzc2gtcnNh
...
AwQFBgcICQo=
-----END OPENSSH PRIVATE KEY-----

PuTTY-User-Key-File-2: ssh-rsa
Encryption: none
Comment: rsa-key-20180822
Public-Lines: 4
AAAAB3NzaC1yc2EAAAADAQABAAAAgQCmz5j5kWUKxfwiv6J0LQ4wN9ekpeORXVaP
...
8pSSWejQ5Q==
Private-Lines: 8
AAAAgH87Sp/YcSw1dKoAZuWb0/2dKkKwMRIYEkS15caRpzAteay6WWX7l1sgBTU7
...
Oa0=
Private-MAC: d53e24f44bde8d1d3844a142fbb1fa7c88ea3585

Note: On Linux/Unix the PFX/PKCS12 format is not supported. On Unix/Linux the default format is "PEM".

Note: ExportCertificate is not support on macOS.

When calling ImportCertificate if a matching certificate or a link to a matching certificate already exists in the Windows certificate store this setting governs what action will be taken. Possible values are:

When calling ImportCertificate, this value controls the type of the certificate store being specified in the first parameter.

This config can take one of the following values:

Note that this functionality is currently for Windows platforms only.

This setting specifies the JWK algorithm. It can be set before calling ExportCertificate (if ExportFormat is set to JWK) or SaveCertificate (if CertificateOutputFormat is set to JWK) to control the key Id used to create the JWK. It will be populated if a JWK-formatted is loaded into the class.

Valid values are:

• (empty string)
• HS256
• HS384
• HS512
• RS256
• RS384
• RS512
• EC256
• EC384
• EC512

This setting specifies the JWK key Id. It can be set before calling ExportCertificate (if ExportFormat is set to JWK) or SaveCertificate (if CertificateOutputFormat is set to JWK) to control the key Id used to create the JWK. It will be populated if a JWK-formatted is loaded into the class.

This setting specifies the intended key operations for the JWK. It can be set before calling ExportCertificate (if ExportFormat is set to JWK) or SaveCertificate (if CertificateOutputFormat is set to JWK) to control the key Id used to create the JWK. It will be populated if a JWK-formatted is loaded into the class.

This setting format is a JSON array. Examples: ["sign","verify"] or ["encrypt"].

This setting specifies the JWK key Id. It can be set before calling ExportCertificate (if ExportFormat is set to JWK) or SaveCertificate (if CertificateOutputFormat is set to JWK) to control the key Id used to create the JWK. It will be populated if a JWK-formatted is loaded into the class.

Valid values are enc and sig.

This setting controls the format of CertPublicKey and CertPrivateKey. By default these properties hold PEM formatted public and private key data. When set to 1 (XML) the keys are stored in a XML format. This only affects the values returned by the class; the actual keys remain the same regardless of this setting. Possible values are:

• 0 (PEM - default)
• 1 (XML)

If this is false (default), the component will throw an error if a duplicate key exists while generating a new keyset using CreateKey. If set to true, the component will replace a key if it already exists when generating new keys.

This allows Subject Alternative Names to be added to a Certificate Signing request. The setting only supports email, DNS, URI, and IPv4 addresses. Separate alternative names should be separated by commas. For example:

string altNames = "email:copy,dns:domain.com,dns.1:other.domain.com,uri:http://www.domain.com,ip:192.168.1.102"

This setting holds the certificate data that is saved when SaveCertificate is called with an empty FileName parameter. If CertificateOutputFormat is set to "P7B" this setting holds the hex encoded P7B file data. If CertificateOutputFormat is set to any other value this holds the raw certificate content (not encoded).

If there are no events to process when DoEvents is called, the class will wait for the amount of time specified here before returning. The default value is 20.

The default code page is the Active Code Page (0).

The following is a list of valid code page identifiers:

The following is a list of valid code page identifiers for Mac OS only:

By default the class will use the system security libraries to perform cryptographic functions. Setting this to True tells the class to use the internal implementation instead of using the system's security API.