从UWP应用安装信任锚或证书

Question

I am working on a key management application for the universal windows platform and would like to install CA certificates and trust anchors that can be used by system apps and 3rd-party apps. I have tried using a combination of CertificateStores.GetStoreByName and CertificateStore.Add as well as a call accessed via P/Invoke to CertAddEncodedCertificateToStore. Unfortunately, in both cases the calls succeed but the certificates are not visible using MMC and they do not appear to be used by other applications.

Is there a means of installing certificates such that they are usable system-wide (including outside the app container)? Is there any means of viewing what certificates have been installed within an app container?

Answer 1

By default no. Please check introduction to certificates article.

Shared certificate stores

UWP apps use the new isolationist application model introduced in Windows 8. In this model, apps run in low-level operating system construct, called an app container, that prohibits the app from accessing resources or files outside of itself unless explicitly permitted to do so. The following sections describe the implications this has on public key infrastructure (PKI).

Certificate storage per app container

Certificates that are intended for use in a specific app container are stored in per user, per app container locations. An app running in an app container has write access to only its own certificate storage. If the application adds certificates to any of its stores, these certificates cannot be read by other apps. If an app is uninstalled, any certificates specific to it are also removed. An app also has read access to local machine certificate stores other than the MY and REQUEST store.

Anyway, you can add a capability to your application in Package.appxmanifest. The sharedUserCertificates capability grants an app container read access to the certificates and keys contained in the user MY store and the Smart Card Trusted Roots store.

  <Capabilities>
    <uap:Capability Name="sharedUserCertificates" />
  </Capabilities>

I just added it for testing purpose (UWP application) and the following code works fine. Certificate is added on user MY store.

string pfxCertificate = null;
string pfxPassword = "";    

FileOpenPicker filePicker = new FileOpenPicker();
filePicker.FileTypeFilter.Add(".pfx");
filePicker.CommitButtonText = "Open";

try
{
    StorageFile file = await filePicker.PickSingleFileAsync();
    if (file != null)
    {
        // file was picked and is available for read
        // try to read the file content
        IBuffer buffer = await FileIO.ReadBufferAsync(file);
        using (DataReader dataReader = DataReader.FromBuffer(buffer))
        {
            byte[] bytes = new byte[buffer.Length];
            dataReader.ReadBytes(bytes);
            // convert to Base64 for using with ImportPfx
            pfxCertificate = System.Convert.ToBase64String(bytes);
        }

        await CertificateEnrollmentManager.UserCertificateEnrollmentManager.ImportPfxDataAsync(
            pfxCertificate,
            pfxPassword,
            ExportOption.NotExportable,
            KeyProtectionLevel.NoConsent,
            InstallOptions.None,
            "Test");
    }
}
catch (Exception ex)
{
    Debug.WriteLine(ex.Message);
}

A sample is available on 8.1 if it helps. Cryptography and Certificate sample