CertMgr Configuration

The component accepts one or more of the following configuration settings. Configuration settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the component, access to these internal properties is provided through the Config method.

CertMgr Configuration Settings

CertComment: A comment to include in a saved certificate.

This settings specified the comment to use when calling SaveCertificate. This can only be used when CertificateOutputFormat is set to a value other than the default value. When CertificateOutputFormat is set to "SSH2PublicKey" the value of this setting should be the full header. For instance: "Comment: My Comment".

CertificateOutputFormat: The format of the certificate to save.

By default when SaveCertificate is called the certificate will be written in a PEM format. You may change the format by setting this setting to "P7B", "SSH2PublicKey", or "OpenSSHPublicKey". Set this to the value "PEM" to specify the default behavior.

CertKeyLength: The public key length for created certificates and keys.

When CreateCertificate creates a new certificate and associated key, or when CreateKey creates a key, this setting determines the length of the new public key (in bits). The default value is 1024.

CertKeyType: The types of keys created for new certificates.

When CreateCertificate creates a new certificate and associated key, or when CreateKey creates a key, this setting determines the type of key generated: 1 for key exchange (encryption) keys, and 2 for digital signature keys. The default value is 1.

CertSignatureAlgorithm: The signature algorithm used when creating certificates.

When CreateCertificate or IssueCertificate creates a new certificate, the signature algorithm used is specified by this setting. Possible values are:

MD2
MD5
SHA1
SHA256
SHA384
SHA512

If no value is specified, the component will use SHA1 as the signature algorithm.

CertValidityTime: The validity period for the certificate.

When CreateCertificate creates a new certificate, the certificate is valid the moment it is created. CertValidityTime determines the number of days until expiration. The default value is 365 days.

CSP: The Cryptographic Service Provider.

The name of the Cryptographic Service Provider used to provide access to certificate signing operations.

ImportCertAction: Specified the action to take if a matching certificate or a link to a matching certificate already exists.

When calling ImportCertificate if a matching certificate or a link to a matching certificate already exists in the Windows certificate store this setting governs what action will be taken. Possible values are:


1	CERT_STORE_ADD_NEW - Imports a certificate only if no existing certificate is present.
2	CERT_STORE_ADD_USE_EXISTING - If an existing certificate is found, it is not replaced.
3 (default)	CERT_STORE_ADD_REPLACE_EXISTING - If an existing certificate is found it is replaced.
4	CERT_STORE_ADD_ALWAYS - No checks are performed and a new certificate is always added to the store. This can result in duplicates.
5	CERT_STORE_ADD_REPLACE_EXISTING_INHERIT_PROPERTIES - If an existing certificate is found it is replaced, and the new certificate inherits properties from the certificate it replaces.
6	CERT_STORE_ADD_NEWER - Imports a certificate only if the certificate is newer than an existing matching certificate.
7	CERT_STORE_ADD_NEWER_INHERIT_PROPERTIES - Imports a certificate only if the certificate is newer than an existing matching certificate, and inherits the properties of old certificate it replaces.

KeyFormat: How the public and private key are formatted.

This setting controls the format of PublicKey and PrivateKey. By default these fields hold PEM formatted public and private key data. When set to 1 (XML) the keys are stored in a XML format. This only affects the values returned by the component; the actual keys remain the same regardless of this setting. Possible values are:

0 (PEM - default)
1 (XML)

The default value is 0 (PEM).

ReplaceKey: Whether or not to replace an existing key when creating a new key.

If this is false (default), the component will throw an error if a duplicate key exists while generating a new keyset using CreateKey. If set to true, the component will replace a key if it already exists when generating new keys.

RequestSubjectAltNames: Subject Alternative Names for a Certificate Signing Request.

This allows Subject Alternative Names to be added to a Certificate Signing request. The setting only supports email, DNS, URI, and IPv4 addresses. Separate alternative names should be separated by commas. For example:

string altNames = "email:copy,dns:domain.com,dns.1:other.domain.com,uri:http://www.domain.com,ip:192.168.1.102"

SubjectAltNames: Subject Alternative Names for creating or issuing certificates.

This allows the Subject Alternative Names extension to be specified when creating or issuing a certificate via CreateCertificate or IssueCertificate. This setting only supports email, DNS, URI, and IPv4 addresses. Separate alternative names should be separated by commas. For example:

string altNames = "email:copy,dns:domain.com,dns.1:other.domain.com,uri:http://www.domain.com,ip:192.168.1.102"

Base Configuration Settings


	GUIAvailable: Tells the component whether or not a message loop is available for processing events. In a GUI-based application, long-running blocking operations may cause the application to stop responding to input until the operation returns. The component will attempt to discover whether or not the application has a message loop and, if one is discovered, it will process events in that message loop during any such blocking operation. In some non-GUI applications an invalid message loop may be discovered that will result in errant behavior. In these cases, setting GuiAvailable to false will ensure that the component does not attempt to process external events.
	UseBackgroundThread: Whether threads created by the component are background threads. If set to True, when the component creates a thread the thread's IsBackground property will be explicitly set to True. By default this setting is False.
	UseManagedSecurityAPI: Tells the component whether or not to use the system security libraries or a managed implementation. By default the component will use the system security libraries to perform cryptographic functions. This means calls to unmanaged code will be made. In certain environments this is not desirable. To use a completely managed security implementation set this setting to True. Setting this to True tells the component to use the internal managed implementation instead of using the system's security API. Note that when this value is set the product's system dll is no longer required as a reference, as all unmanaged code is stored in this file.