certtostore

package module
v1.0.7 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 31, 2026 License: Apache-2.0 Imports: 14 Imported by: 0

README

CertToStore

Go Tests

CertToStore is a multi-platform package that allows you to work with x509 certificates on Linux and the certificate store on Windows.

Why CertToStore?

CertToStore was created to solve some specific problems when working with certificates using Go. Ever wanted to create public/private key pairs using the TPM or create certificate requests using TPM backed keys? Both are possible using CertToStore on Windows.

Native Certificate Store Access without the prompts Certificate storage in CertToStore under Windows is implemented using native Windows API calls. This makes the package efficient and avoids problematic user prompts and interactions.

With CertToStore, you can also lookup and use existing certificates with their private keys through CNG, regardless of how they were issued (TPM or Software backed).

Built-in support for Cryptography API: Next Generation (CNG) CertToStore for Windows was built from the ground up to use Microsoft's Cryptography API: Next Generation (CNG). This grants certificates generated, requested, and stored using CertToStore the ability to use your computer's TPM to store private key material safely.

Compatibile with packages that use x509.Certificate Certificates managed by CertToStore are compatible with other packages that use x509.Certificate. Want to generate certificate requests using the TPM, and send them to your own third-party CA? Have a Go based web server that you want to use with a TPM backed certificate? Sure thing.

Contact

We have a public discussion list at certtostore-discuss@googlegroups.com

Disclaimer

This is not an official Google product.

Documentation

Overview

Package certtostore handles storage for certificates.

Package certtostore handles storage for certificates. This file provides a high-level API layer over the existing WinCertStore primitives for use by EverTrust integrations.

Index

Constants

View Source 
const (

	// NCryptPadOAEPFlag is used with Decrypt to specify whether to use OAEP.
	NCryptPadOAEPFlag = 0x00000004 // NCRYPT_PAD_OAEP_FLAG

	// ProviderMSPlatform represents the Microsoft Platform Crypto Provider
	ProviderMSPlatform = "Microsoft Platform Crypto Provider"
	// ProviderMSSoftware represents the Microsoft Software Key Storage Provider
	ProviderMSSoftware = "Microsoft Software Key Storage Provider"
	// ProviderMSLegacy represents the CryptoAPI compatible Enhanced Cryptographic Provider
	ProviderMSLegacy = "Microsoft Enhanced Cryptographic Provider v1.0"

	// CertStoreReadOnly represents read only permissions
	CertStoreReadOnly = 0x00008000 // CERT_STORE_READONLY_FLAG
	// CertStoreSaveToFile represents write to file permissions
	CertStoreSaveToFile = 0x00001000 // CERT_STORE_SAVE_TO_FILE
	// CertStoreOpenMaximumAllowed represents all permissions
	CertStoreOpenMaximumAllowed = 0x00001000 // CERT_STORE_MAXIMUM_ALLOWED_FLAG
)
View Source 
const (
	StandaloneWorkstation = iota
	MemberWorkstation
	StandaloneServer
	MemberServer
	BackupDomainController
	PrimaryDomainController
)

Constants for DomainRole https://msdn.microsoft.com/en-us/library/aa394102

Variables

View Source 
var (
	// ErrNoNetworkAdapter is returned when no network adapter is detected.
	ErrNoNetworkAdapter = errors.New("network adapter not detected")
)

Functions

func FreeCertContext 

func FreeCertContext(ctx *windows.CertContext) error

FreeCertContext frees a certificate context after use.

func NetInfo 

func NetInfo() ([]string, error)

NetInfo obtains the mac address of all local non-USB network devices

func PEMToX509 

func PEMToX509(b []byte) (*x509.Certificate, error)

PEMToX509 takes a raw PEM certificate and decodes it to an x509.Certificate.

func RemoveCertByContext 

func RemoveCertByContext(certContext *windows.CertContext) error

RemoveCertByContext wraps CertDeleteCertificateFromStore. If the call succeeds, nil is returned, otherwise the extended error is returned.

func User 

func User() (string, error)

User will obtain the current user from the OS.

func UserSID 

func UserSID() (string, error)

UserSID will obtain the SID of the current user from the OS.

func ValidateGenerateOpts 

func ValidateGenerateOpts(opts GenerateOpts) error

ValidateGenerateOpts ensures that the provided GenerateOpts are valid.

Types

type Algorithm 

type Algorithm string

Algorithm indicates an asymmetric algorithm used by the credential. 

const (
	EC  Algorithm = "EC"
	RSA Algorithm = "RSA"
)

Algorithms types supported by this package.

func (Algorithm) Tox509 

func (a Algorithm) Tox509() x509.PublicKeyAlgorithm

type CertResult 

type CertResult struct {
	Certificate *x509.Certificate
	// Chain contains the verified certificate chains built from the leaf.
	// Each inner slice starts with the leaf and ends at a root.
	Chain []*x509.Certificate
	// KeyStatus is non-nil when a private key associated with the certificate
	// was found in the store.
	KeyStatus *KeyStatus
}

CertResult bundles a certificate with its chain and associated key status.

type CertStorage 

type CertStorage interface {
	// Cert returns the current X509 certificate or nil if no certificate is installed.
	Cert() (*x509.Certificate, error)
	// Intermediate returns the current intermediate X509 certificate or nil if no certificate is installed.
	Intermediate() (*x509.Certificate, error)
	// CertificateChain returns the leaf and subsequent certificates.
	CertificateChain() ([][]*x509.Certificate, error)
	// Generate generates a new private key in the storage and returns a signer that can be used
	// to perform signatures with the new key and read the public portion of the key. CertStorage
	// implementations should strive to ensure a Generate call doesn't actually destroy any current
	// key or cert material and to only install the new key for clients once Store is called.
	Generate(opts GenerateOpts) (crypto.Signer, error)
	// Store finishes the cert installation started by the last Generate call with the given cert and
	// intermediate.
	Store(cert *x509.Certificate, intermediate *x509.Certificate) error
	// Key returns the certificate as a Credential (crypto.Signer and crypto.Decrypter).
	Key() (Credential, error)
}

CertStorage exposes the different backend storage options for certificates.

type Credential 

type Credential interface {
	// Public returns the public key corresponding to the leaf certificate.
	Public() crypto.PublicKey
	// Sign signs digest with the private key.
	Sign(rand io.Reader, digest []byte, opts crypto.SignerOpts) (signature []byte, err error)
	// Decrypt decrypts msg. Returns an error if not implemented.
	Decrypt(rand io.Reader, msg []byte, opts crypto.DecrypterOpts) (plaintext []byte, err error)
}

Credential provides access to a certificate and is a crypto.Signer and crypto.Decrypter.

type DecrypterOpts 

type DecrypterOpts struct {
	// Hashfunc represents the hashing function that was used during
	// encryption and is mapped to the Microsoft equivalent LPCWSTR.
	Hashfunc crypto.Hash
	// Flags represents the dwFlags parameter for NCryptDecrypt
	Flags uint32
}

DecrypterOpts implements crypto.DecrypterOpts and contains the flags required for the NCryptDecrypt system call.

type FileStorage 

type FileStorage struct {
	// contains filtered or unexported fields
}

FileStorage exposes the file storage (on disk) backend type for certificates. The certificate id is used as the base of the filename within the basepath.

func NewFileStorage 

func NewFileStorage(basepath string) *FileStorage

NewFileStorage sets up a new file storage struct for use by StoreCert.

func (FileStorage) Cert 

func (f FileStorage) Cert() (*x509.Certificate, error)

Cert returns the FileStorage's current cert or nil if there is none.

func (FileStorage) CertificateChain 

func (f FileStorage) CertificateChain() ([][]*x509.Certificate, error)

CertificateChain returns chains of the leaf and subsequent certificates.

func (FileStorage) Decrypt 

func (f FileStorage) Decrypt(rand io.Reader, msg []byte, opts crypto.DecrypterOpts) ([]byte, error)

Decrypt decrypts msg. Returns an error if not implemented. The opts are passed to the private key's Decrypt method, as per the crypto.Decrypter interface. https://pkg.go.dev/crypto#Decrypter Only RSA keys are supported for decryption.

func (*FileStorage) Generate 

func (f *FileStorage) Generate(opts GenerateOpts) (crypto.Signer, error)

Generate creates a new ECDSA or RSA private key and returns a signer that can be used to make a CSR for the key.

func (FileStorage) Intermediate 

func (f FileStorage) Intermediate() (*x509.Certificate, error)

Intermediate returns the FileStorage's current intermediate cert or nil if there is none.

func (FileStorage) Key 

func (f FileStorage) Key() (Credential, error)

Key returns a Credential for the current FileStorage.

func (FileStorage) Public 

func (f FileStorage) Public() crypto.PublicKey

Public returns the public key corresponding to the leaf certificate or nil if there is none.

func (FileStorage) Sign 

func (f FileStorage) Sign(rand io.Reader, digest []byte, opts crypto.SignerOpts) ([]byte, error)

Sign returns a signature for the provided digest. The opts are passed to the private key's Sign method, as per the crypto.Signer interface. https://pkg.go.dev/crypto#Signer

func (*FileStorage) Store 

func (f *FileStorage) Store(cert *x509.Certificate, intermediate *x509.Certificate) error

Store finishes our cert installation by PEM encoding the cert, intermediate, and key and storing them to disk.

type GenerateOpts 

type GenerateOpts struct {
	// Algorithm to be used, either RSA or EC.
	Algorithm Algorithm
	// Size is used to specify the bit size of the RSA key or curve for EC keys.
	Size int
}

GenerateOpts holds parameters used to generate a private key.

type Key 

type Key struct {
	Container       string
	LegacyContainer string
	AlgorithmGroup  string
	// contains filtered or unexported fields
}

Key implements crypto.Signer and crypto.Decrypter for key based operations.

func (Key) Decrypt 

func (k Key) Decrypt(rand io.Reader, blob []byte, opts crypto.DecrypterOpts) ([]byte, error)

Decrypt returns the decrypted contents of the encrypted blob, and implements crypto.Decrypter for Key.

func (Key) Public 

func (k Key) Public() crypto.PublicKey

Public exports a public key to implement crypto.Signer

func (*Key) SetACL 

func (k *Key) SetACL(access string, sid string, perm string) error

SetACL sets the requested permissions on the private key. If a cryptoAPI compatible copy of the key is present, the same ACL is set.

func (Key) Sign 

func (k Key) Sign(_ io.Reader, digest []byte, opts crypto.SignerOpts) ([]byte, error)

Sign returns the signature of a hash to implement crypto.Signer

func (Key) TransientTpmHandle 

func (k Key) TransientTpmHandle() uintptr

TransientTpmHandle returns the key's underlying transient TPM handle.

type KeyStatus 

type KeyStatus struct {
	// Container is the unique NCrypt key container name; a stable identifier
	// for the key even when the key is not exportable.
	Container string
	// IsExportable indicates the key can be exported from the provider.
	IsExportable bool
	// IsHardware indicates the key is backed by a hardware security module (TPM/HSM).
	IsHardware bool
	// Signer implements crypto.Signer for the private key.
	// Always non-nil when a KeyStatus is returned.
	Signer crypto.Signer
}

KeyStatus describes the state of a private key associated with a certificate.

type Store 

type Store struct {
	// contains filtered or unexported fields
}

Store provides a high-level interface for Windows certificate store operations. Obtain one via OpenStore and release resources with Close.

func OpenStore 

func OpenStore(ctx StoreContext, storeName string, opts StoreOpenOptions) (*Store, error)

OpenStore opens a Windows certificate store.

  • ctx selects UserStore or MachineStore.
  • storeName is the store to open: "MY", "ROOT", "CA", or any custom name.
  • opts configures the crypto provider, key container, and access mode.

Call Close on the returned Store when finished.

func (*Store) Close 

func (s *Store) Close() error

Close releases all resources held by the Store.

func (*Store) DeleteCertByThumbprint 

func (s *Store) DeleteCertByThumbprint(thumbprint string) error

DeleteCertByThumbprint permanently removes the certificate identified by its hex-encoded SHA-1 thumbprint from the store. Returns nil if not found.

func (*Store) FindCertByCommonName 

func (s *Store) FindCertByCommonName(cn string) (*CertResult, error)

FindCertByCommonName finds the first certificate whose subject Common Name contains cn in the store.

Returns (nil, nil) when no matching certificate exists. Returns a CertResult with KeyStatus set when a private key is accessible.

func (*Store) FindCertByThumbprint 

func (s *Store) FindCertByThumbprint(thumbprint string) (*CertResult, error)

FindCertByThumbprint finds a certificate in the store by its SHA-1 thumbprint (hex-encoded).

Returns (nil, nil) when no matching certificate exists. Returns a CertResult with KeyStatus set when a private key is accessible.

func (*Store) GenerateKey 

func (s *Store) GenerateKey(opts GenerateOpts) (crypto.Signer, error)

GenerateKey generates a new private key inside the Windows key store and returns a crypto.Signer that can be used to create a CSR.

After the signed certificate is obtained from the CA, call StoreCertWithChain to associate the certificate with the generated key and finalize enrollment.

func (*Store) ImportCertAndKey 

func (s *Store) ImportCertAndKey(cert *x509.Certificate, chain []*x509.Certificate, key crypto.PrivateKey) error

ImportCertAndKey imports a certificate, its intermediate chain, and an externally generated private key into the store.

The private key is imported into the configured CNG provider and persisted. Supported key types: *rsa.PrivateKey and *ecdsa.PrivateKey.

func (*Store) RenewCert 

func (s *Store) RenewCert(cn string, newCert *x509.Certificate, newChain []*x509.Certificate) error

RenewCert replaces the certificate currently identified by cn with a new certificate and chain. The private key is unchanged; only the cert material is updated.

Use GenerateKey + StoreCertWithChain instead when the key must also be rotated.

func (*Store) StoreCertWithChain 

func (s *Store) StoreCertWithChain(cert *x509.Certificate, chain []*x509.Certificate) error

StoreCertWithChain imports a leaf certificate and its intermediate chain into the store. The leaf must already have a matching private key in the Windows key store (e.g. generated via GenerateKey).

The leaf is stored in the store opened by OpenStore. Intermediates are stored in the "CA" system store for chain building.

type StoreContext 

type StoreContext int

StoreContext specifies whether to use the current-user or local-machine store. 

const (
	// MachineStore opens the local machine certificate store.
	// Requires administrator privileges for write access.
	MachineStore StoreContext = iota
	// UserStore opens the current user certificate store.
	UserStore
)

type StoreOpenOptions 

type StoreOpenOptions struct {
	// Provider is the CNG key storage provider name.
	// Defaults to ProviderMSSoftware when empty.
	Provider string
	// Container is the key container name within the provider.
	// Used when generating or opening a specific key.
	Container string
	// LegacyKey requests a CryptoAPI-compatible copy of every key written.
	LegacyKey bool
	// ReadOnly opens the store in read-only mode.
	ReadOnly bool
}

StoreOpenOptions holds optional parameters for OpenStore.

type Win32_ComputerSystem 

type Win32_ComputerSystem struct {
	DNSHostName string
	Domain      string
	DomainRole  int
	Model       string
}

Win32_ComputerSystem is used to store WMI query results

func CompInfo 

func CompInfo() (*Win32_ComputerSystem, error)

CompInfo populates a struct with computer information through WMI

type Win32_ComputerSystemProduct 

type Win32_ComputerSystemProduct struct {
	Vendor, UUID, IdentifyingNumber string
}

Win32_ComputerSystemProduct is used to obtain the UUID of the computer main board

func CompProdInfo 

func CompProdInfo() (*Win32_ComputerSystemProduct, error)

CompProdInfo populates a struct with computer system product information through WMI

type Win32_NetworkAdapter 

type Win32_NetworkAdapter struct {
	MACAddress string
}

Win32_NetworkAdapter is used to ID the physical local network adapter through WMI

type WinCertStorage 

type WinCertStorage interface {
	CertStorage

	// Remove removes certificates issued by any of w.issuers from the user and/or system cert stores.
	// If it is unable to remove any certificates, it returns an error.
	Remove(removeSystem bool) error

	// Link will associate the certificate installed in the system store to the user store.
	Link() error

	// Close frees the handle to the certificate provider, the certificate store, etc.
	Close() error

	// CertWithContext performs a certificate lookup using value of issuers that
	// was provided when WinCertStore was created. It returns both the certificate
	// and its Windows context, which can be used to perform other operations,
	// such as looking up the private key with CertKey().
	//
	// You must call FreeCertContext on the context after use.
	CertWithContext() (*x509.Certificate, *windows.CertContext, error)

	// CertKey wraps CryptAcquireCertificatePrivateKey. It obtains the CNG private
	// key of a known certificate and returns a pointer to a Key which implements
	// both crypto.Signer and crypto.Decrypter. When a nil cert context is passed
	// a nil key is intentionally returned, to model the expected behavior of a
	// non-existent cert having no private key.
	// https://docs.microsoft.com/en-us/windows/win32/api/wincrypt/nf-wincrypt-cryptacquirecertificateprivatekey
	CertKey(cert *windows.CertContext) (*Key, error)

	// StoreWithDisposition imports certificates into the Windows certificate store.
	// disposition specifies the action to take if a matching certificate
	// or a link to a matching certificate already exists in the store
	// https://learn.microsoft.com/en-us/windows/win32/api/wincrypt/nf-wincrypt-certaddcertificatecontexttostore
	StoreWithDisposition(cert *x509.Certificate, intermediate *x509.Certificate, disposition uint32) error
}

WinCertStorage provides windows-specific additions to the CertStorage interface.

type WinCertStore 

type WinCertStore struct {
	Prov     uintptr
	ProvName string
	// contains filtered or unexported fields
}

WinCertStore is a CertStorage implementation for the Windows Certificate Store.

func OpenWinCertStore 

func OpenWinCertStore(provider, container string, issuers, intermediateIssuers []string, legacyKey bool) (*WinCertStore, error)

OpenWinCertStore creates a WinCertStore with keys accessible by all users on a machine. Call Close() when finished using the store.

func OpenWinCertStoreCurrentUser 

func OpenWinCertStoreCurrentUser(provider, container string, issuers, intermediateIssuers []string, legacyKey bool) (*WinCertStore, error)

OpenWinCertStoreCurrentUser creates a WinCertStore with keys accessible by current user. Call Close() when finished using the store.

func OpenWinCertStoreWithOptions 

func OpenWinCertStoreWithOptions(opts WinCertStoreOptions) (*WinCertStore, error)

OpenWinCertStoreWithOptions creates a WinCertStore with the provided options. This function provides maximum flexibility for configuring the certificate store, including advanced options like custom store flags and provider selection.

The function validates all options before attempting to open the store, returning detailed error information if any configuration is invalid or incompatible.

Parameters:

  • opts: Comprehensive configuration options for the certificate store

Returns:

  • *WinCertStore: A configured certificate store ready for use
  • error: Detailed error information if store creation fails

Example usage: 

opts := WinCertStoreOptions{
    Provider: ProviderMSSoftware,
    Container: "MY",
    Issuers: []string{"CN=My CA"},
    StoreFlags: certStoreReadOnly,
    CurrentUser: true,
}
store, err := OpenWinCertStoreWithOptions(opts)
if err != nil {
    return fmt.Errorf("failed to open certificate store: %v", err)
}
defer store.Close()

Common errors:

  • Provider not available or accessible
  • Invalid or incompatible store flags
  • Missing required options (provider, container, issuers)
  • Insufficient privileges for machine store access

func (*WinCertStore) Cert 

func (w *WinCertStore) Cert() (*x509.Certificate, error)

Cert returns the current cert associated with this WinCertStore or nil if there isn't one.

func (*WinCertStore) CertByCommonName 

func (w *WinCertStore) CertByCommonName(commonName string) (*x509.Certificate,
	*windows.CertContext, [][]*x509.Certificate, error)

CertByCommonName searches for a certificate by its common name in the store. The returned *windows.CertContext must be freed by the caller using FreeCertContext to avoid resource leaks.

func (*WinCertStore) CertKey 

func (w *WinCertStore) CertKey(cert *windows.CertContext) (*Key, error)

CertKey wraps CryptAcquireCertificatePrivateKey. It obtains the CNG private key of a known certificate and returns a pointer to a Key which implements both crypto.Signer and crypto.Decrypter. When a nil cert context is passed a nil key is intentionally returned, to model the expected behavior of a non-existent cert having no private key. https://docs.microsoft.com/en-us/windows/win32/api/wincrypt/nf-wincrypt-cryptacquirecertificateprivatekey

func (*WinCertStore) CertWithContext 

func (w *WinCertStore) CertWithContext() (*x509.Certificate, *windows.CertContext, error)

CertWithContext performs a certificate lookup using value of issuers that was provided when WinCertStore was created. It returns both the certificate and its Windows context, which can be used to perform other operations, such as looking up the private key with CertKey().

You must call FreeCertContext on the context after use.

func (*WinCertStore) CertificateChain 

func (w *WinCertStore) CertificateChain() ([][]*x509.Certificate, error)

CertificateChain returns the leaf and subsequent certificates.

func (*WinCertStore) Close 

func (w *WinCertStore) Close() error

Close frees the handle to the certificate provider, the certificate store, etc.

func (*WinCertStore) Generate 

func (w *WinCertStore) Generate(opts GenerateOpts) (crypto.Signer, error)

Generate returns a crypto.Signer representing either a TPM-backed or software backed key, depending on support from the host OS key size is set to the maximum supported by Microsoft Software Key Storage Provider

func (*WinCertStore) Intermediate 

func (w *WinCertStore) Intermediate() (*x509.Certificate, error)

Intermediate returns the current intermediate cert associated with this WinCertStore or nil if there isn't one.

func (*WinCertStore) Key 

func (w *WinCertStore) Key() (Credential, error)

Key opens a handle to an existing private key and returns key. Key implements both crypto.Signer and crypto.Decrypter.

Important: The Key lookup is based on the provider passed to OpenWinCertStore. This *may not match* the certificate obtained by Cert() for the same store, which may be associated with a different provider. Use CertKey() to derive a key directly from a Cert in situations where both are needed. 

func (w *WinCertStore) Link() error

Link will associate the certificate installed in the system store to the user store.

func (*WinCertStore) Remove 

func (w *WinCertStore) Remove(removeSystem bool) error

Remove removes certificates issued by any of w.issuers from the user and/or system cert stores. If it is unable to remove any certificates, it returns an error.

func (*WinCertStore) Root 

func (w *WinCertStore) Root(issuer []string) (*x509.Certificate, error)

Root returns the certificate issued by the specified issuer from the root certificate store 'ROOT/Certificates'.

func (*WinCertStore) Store 

func (w *WinCertStore) Store(cert *x509.Certificate, intermediate *x509.Certificate) error

Store imports certificates into the Windows certificate store

func (*WinCertStore) StoreWithDisposition 

func (w *WinCertStore) StoreWithDisposition(cert *x509.Certificate, intermediate *x509.Certificate, disposition uint32) error

StoreWithDisposition imports certificates into the Windows certificate store. disposition specifies the action to take if a matching certificate or a link to a matching certificate already exists in the store https://learn.microsoft.com/en-us/windows/win32/api/wincrypt/nf-wincrypt-certaddcertificatecontexttostore

type WinCertStoreOptions 

type WinCertStoreOptions struct {
	// Provider specifies the cryptographic provider to use for key operations.
	// Common values include:
	//   - ProviderMSPlatform: "Microsoft Platform Crypto Provider"
	//   - ProviderMSSoftware: "Microsoft Software Key Storage Provider"
	//   - ProviderMSLegacy: "Microsoft Enhanced Cryptographic Provider v1.0"
	Provider string

	// Container specifies the key container name within the cryptographic provider.
	// This name uniquely identifies the key pair within the provider.
	Container string

	// Issuers contains the list of certificate issuer distinguished names to search for.
	// The certificate lookup will match against these issuer names.
	Issuers []string

	// IntermediateIssuers contains the list of intermediate certificate issuer distinguished names.
	// These are used for certificate chain validation and storage.
	IntermediateIssuers []string

	// LegacyKey indicates whether to use a legacy key format compatible with CryptoAPI.
	// When true, keys will be stored in a format accessible to older Windows applications.
	LegacyKey bool

	// CurrentUser indicates whether to use the current user's certificate store instead
	// of the local machine store. When false, the local machine store is used, which
	// requires administrator privileges but makes certificates available to all users.
	CurrentUser bool

	// StoreFlags contains additional flags for certificate store operations.
	// These flags control how the certificate store is opened and accessed.
	// Common flags include:
	//   - certStoreReadOnly: Open store in read-only mode
	//   - certStoreSaveToFile: Enable saving store to file
	//   - certStoreCreateNewFlag: Create new store if it doesn't exist
	//   - certStoreOpenExistingFlag: Only open existing stores
	StoreFlags uint32
}

WinCertStoreOptions contains configuration options for opening a certificate store. This struct provides comprehensive control over how a Windows certificate store is opened and configured, including cryptographic providers, key storage options, and store access flags.

func DefaultWinCertStoreOptions 

func DefaultWinCertStoreOptions(provider, container string, issuers, intermediateIssuers []string, legacyKey bool) WinCertStoreOptions

DefaultWinCertStoreOptions returns the default options for opening a certificate store. These options represent a safe, commonly-used configuration suitable for most applications.

Parameters:

  • provider: The cryptographic provider name (e.g., ProviderMSSoftware)
  • container: The key container name
  • issuers: List of certificate issuer distinguished names
  • intermediateIssuers: List of intermediate certificate issuer distinguished names
  • legacyKey: Whether to use legacy CryptoAPI-compatible key format

Returns a WinCertStoreOptions struct with safe defaults:

  • CurrentUser: false (uses machine store)
  • StoreFlags: 0 (no special flags)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.