How to SSL/TLS Client Authentication on Chrome using Custom Cryptographic Service Provider (CSPs)

Question

I had already written a CSP module and it worked well. Here is a problems, I use my CSP module to browser to a web page that required ssl client authentication, and it worked on IE, but not for Chrome. Chrome screen show error This site can't provide a secure connection ERR_BAD_SSL_CLIENT_AUTH_CERT

I use chrome with enable-logging, and an WARNING occur like WARNING:ssl_platform_key_win.cc(386)] Could not acquire private key: Error (0x13D) while retrieving error. (0xC0000225) WARNING:ssl_platform_key_win.cc(386)] Could not acquire private key: Error (0x13D) while retrieving error. (0xC0000225)

HCERTSTORE hStore = NULL;
CRYPT_KEY_PROV_INFO key_prov_info = { 0 };
PCCERT_CONTEXT pCertContext = nullptr;
std::vector<BYTE> der_encoded_cert;

hStore = CertOpenSystemStore(NULL, L"MY");
if (!hStore)
{
    goto Exit;
}

der_encoded_cert = LoadFromFile();

pCertContext = CertCreateCertificateContext(X509_ASN_ENCODING, der_encoded_cert.data(), der_encoded_cert.size());
if (!pCertContext)
{
    goto Exit;
}

key_prov_info.dwProvType = MY_PROVIDER_TYPE; // Or YOUR_PROVIDER_TYPE
key_prov_info.dwKeySpec = AT_SIGNATURE; // Or AT_KEYEXCHANGE
key_prov_info.pwszContainerName = L"My key name";
key_prov_info.dwFlags = CERT_SET_KEY_PROV_HANDLE_PROP_ID;
key_prov_info.cProvParam = L"My provider Name";
key_prov_info.pwszProvName = nullptr;
key_prov_info.rgProvParam = 0;


if (!CertSetCertificateContextProperty(pCertContext, CERT_KEY_PROV_INFO_PROP_ID, 0, &key_prov_info))
{
    goto Exit;
}

if (!CertAddCertificateContextToStore(hStore, pCertContext, CERT_STORE_ADD_ALWAYS, NULL))
{
    goto Exit;
}

How to detect this problem come from? I can only export chrome logging.

Answer 1

Chrome browser does not use Microsoft CAPI (CryptoAPI) for cryptographic services, but it includes the BoringSSL library instead. Hence, Chrome will not have access to your custom CSP module.

You should be able to import the client certificate and private key (Settings -> Advanced -> Privacy and security -> Manage Certificates -> Personal -> Import).

You don't explain why you need a custom CSP to do this with IE as importing the cert and private key into Window's certificate store should also make ssl client certificates work without it. HTH.