CertificateStorage Component

Properties   Methods   Events   Configuration Settings   Errors  

The CertificateStorage component works with collections of certificates.

Syntax

TsbxCertificateStorage

Remarks

CertificateStorage can work with certificates residing on a variety of media. Among others, it can access certificates residing in files, Windows and macOS system stores, and PKCS#11 devices. All such kinds of media can be accessed via a simple, unified interface, which makes CertificateStorage a handy certificate access option. Most users of SecureBlackbox use this component to access certificates residing on hardware devices. CertificateStorage is also a good alternative to CertificateManager where the certificate file contains more than one certificate.

To access certificates stored on certain type of media, start with the Open method. Provide the location of your certificates via a uniform URI-like specifier. Once the storage has been opened, you can access the certificates contained in it via the Certificates property.

Iterate over certificates by using the Certificates property, or use filtering facilities such as Select and SelectChain. You can add certificates to the storage with the Add, AddFromFile, and AddPinned methods. In the latter case please assign the certificate object to be imported to the PinnedCert property.

Use CreateNew method to create a new storage. Note that not all storage kinds can be created.

When you have finished working with the certificate storage, close it with the Close method.

Certain types of stores must be kept open for the certificates to continue to be usable. This means that while you can copy a certificate to a different storage, or assign it to a different component, you still must keep the storage it originates from open for as long as you intend to use that certificate in your code. This is because the storage is often a bridge between a certificate and its private key, and by closing the storage early you are destroying this bridge prematurely. See the code example below:

  // This code, although syntactically correct, will fail because the storage is closed too early:
  storage.Open("pkcs11://user:12345@localhost/C:/Windows/System32/asepkcs.dll");
  pdfSigner.SigningCertificate = storage.Certificates[0];
  storage.Close(false); // the private key of the SigningCertificate gets lost after this call
  pdfSigner.Sign(); // returns an error

  // This code will work as expected
  storage.Open("pkcs11://user:12345@localhost/C:/Windows/System32/asepkcs.dll");
  pdfSigner.SigningCertificate = storage.Certificates[0];
  pdfSigner.Sign();
  storage.Close(false);