The CertificateStorage component works with collections of certificates.
CertificateStorage can work with certificates residing on a variety of media. Among others, it can access certificates residing in files, Windows and macOS system stores, and PKCS#11 devices. All such kinds of media can be accessed via a simple, unified interface, which makes CertificateStorage a handy certificate access option. Most users of SecureBlackbox use this component to access certificates residing on hardware devices. CertificateStorage is also a good alternative to CertificateManager where the certificate file contains more than one certificate.
To access certificates stored on certain type of media, start with the Open method. Provide the location of your certificates via a uniform URI-like specifier. Once the storage has been opened, you can access the certificates contained in it via the Certificates property.
Iterate over certificates by using the Certificates property, or use filtering facilities such as Select and SelectChain. You can add certificates to the storage with the Add, AddFromFile, and AddPinned methods. In the latter case please assign the certificate object to be imported to the PinnedCert property.
Use CreateNew method to create a new storage. Note that not all storage kinds can be created.
When you have finished working with the certificate storage, close it with the Close method.
Certain types of stores must be kept open for the certificates to continue to be usable. This means that while you can
copy a certificate to a different storage, or assign it to a different component, you still must keep
the storage it originates from open for as long as you intend to use that certificate in your code.
This is because the storage is often a bridge between a certificate
and its private key, and by closing the storage early you are destroying this bridge prematurely. See the code example below:
// This code, although syntactically correct, will fail because the storage is closed too early: storage.Open("pkcs11://user:12345@localhost/C:/Windows/System32/asepkcs.dll"); pdfSigner.SigningCertificate = storage.Certificates; storage.Close(false); // the private key of the SigningCertificate gets lost after this call pdfSigner.Sign(); // returns an error // This code will work as expected storage.Open("pkcs11://user:12345@localhost/C:/Windows/System32/asepkcs.dll"); pdfSigner.SigningCertificate = storage.Certificates; pdfSigner.Sign(); storage.Close(false);
The following is the full list of the properties of the module with short descriptions. Click on the links for further details.
|Certificates||A collection of certificates contained in the storage.|
|Opened||Indicates whether the storage is in the open state.|
|PinnedCert||A pinned certificate.|
|SelectedCertificates||A collection of selected certificates.|
|StorageID||A unique identifier of this storage.|
|StorageLocation||Specifies the location of the currently opened storage.|
The following is the full list of the methods of the module with short descriptions. Click on the links for further details.
|Add||Adds a certificate to the storage.|
|AddFromFile||Adds a certificate to the storage.|
|AddPinned||Adds the pinned certificate to the storage.|
|Clear||Removes all certificates from the storage.|
|Close||Closes the certificate storage.|
|Config||Sets or retrieves a configuration setting.|
|CreateNew||Creates a new storage.|
|Open||Opens existing storage or creates one in memory.|
|Refresh||Refreshes all storage keychains.|
|Remove||Removes a certificate from the storage.|
|Select||Allows the selection of certificates from the system store.|
|SelectChain||Selects a chain of certificates given its index.|
The following is the full list of the events fired by the module with short descriptions. Click on the links for further details.
|Error||Information about errors during certificate loading or saving.|
|Notification||This event notifies the application about an underlying control flow event.|
|PasswordNeeded||This event is fired when a decryption password is needed.|
The following is a list of configuration settings for the module with short descriptions. Click on the links for further details.
|AuthAttempts||The number of auth/login attempts to try.|
|PKCS11ActiveSlot||The index of the slot that the component is working with.|
|PKCS11NewPIN||Changes the current user's PIN.|
|PKCS11NewUserPIN||Registers a new user PIN.|
|PKCS11PIN||Sets the operation PIN.|
|PKCS11SlotCount||The number of slots exposed in the storage.|
|PKCS11SlotDescription[i]||A human-readable description of the slot.|
|PKCS11SlotLoggedIn[i]||Whether slot i has an active session associated with it.|
|PKCS11SlotPinNeeded[i]||Whether slot i requires you to provide a PIN to log in or sign.|
|PKCS11SlotReadOnly[i]||Whether slot i only supports read-only access.|
|PKCS11SlotTokenLabel[i]||The label assigned to the token.|
|PKCS11SlotTokenModel[i]||The token model.|
|PKCS11SlotTokenPresent[i]||Indicates whether there is a token in the slot.|
|PKCS11SlotTokenSerial[i]||The serial number of the token.|
|PKCS11SlotTokenVendorID[i]||The manufacturer ID of the inserted token.|
|PKCS11SlotVendorID[i]||Returns the manufacturer ID of the slot.|
|TempPath||Path for storing temporary files.|
|CheckKeyIntegrityBeforeUse||Enables or disable private key integrity check before use.|
|CookieCaching||Specifies whether a cookie cache should be used for HTTP(S) transports.|
|Cookies||Gets or sets local cookies for the component (supported for HTTPClient, RESTClient and SOAPClient only).|
|DefDeriveKeyIterations||Specifies the default key derivation algorithm iteration count.|
|EnableClientSideSSLFFDHE||Enables or disables finite field DHE key exchange support in TLS clients.|
|GlobalCookies||Gets or sets global cookies for all the HTTP transports.|
|HttpUserAgent||Specifies the user agent name to be used by all HTTP clients.|
|LogDestination||Specifies the debug log destination.|
|LogDetails||Specifies the debug log details to dump.|
|LogFile||Specifies the debug log filename.|
|LogFilters||Specifies the debug log filters.|
|LogFlushMode||Specifies the log flush mode.|
|LogLevel||Specifies the debug log level.|
|LogMaxEventCount||Specifies the maximum number of events to cache before further action is taken.|
|LogRotationMode||Specifies the log rotation mode.|
|MaxASN1BufferLength||Specifies the maximal allowed length for ASN.1 primitive tag data.|
|MaxASN1TreeDepth||Specifies the maximal depth for processed ASN.1 trees.|
|OCSPHashAlgorithm||Specifies the hash algorithm to be used to identify certificates in OCSP requests.|
|UseOwnDNSResolver||Specifies whether the client components should use own DNS resolver.|
|UseSharedSystemStorages||Specifies whether the validation engine should use a global per-process copy of the system certificate stores.|
|UseSystemOAEPAndPSS||Enforces or disables the use of system-driven RSA OAEP and PSS computations.|
|UseSystemRandom||Enables or disables the use of the OS PRNG.|