Sign xml with thumbprint about signxml HOT 3 CLOSED

Hello,

It is impossible to sign anything with a certificate thumbprint. You have to use the private key that corresponds to the certificate.

Thanks for your interest in SignXML. Since this does not appear to be a bug with the library, I am going to close this issue now.

from signxml.

Hello @kislyuk,

I would like to apologize for being unclear.

The private key of my code signing certificate is stored on an HSM/token.
However, the private key can be accessed via a KSP (Key Storage Provider).

With the help of the KSP and certutil repairstore (https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil#-repairstore) you can, for example, sign a file in signtool as normal using a thumbprint.
The Windows certificate manager shows that the private key is available for the certificate.

Unfortunately, it is not clear to me how I can sign an XML file based on a certificate in the Windows certificate manager (with a private key).

Best regards,
Marcel

from signxml.

I see, thanks for clarifying.

I don't think there are any plans to support Windows certificate services directly, since that is not an open or cross-platform protocol. However, I am researching the possibility of adding support for PKCS#11 in #237 as you noticed. I'm not familiar with the details of Windows certificate services APIs, but if they support PKCS#11, then SignXML should be able to support them in the future.

If you have specific ideas or test cases or code references for PKCS#11 enabled support for your application, please feel free to comment in #237.

from signxml.