Retrieving private key from USB EV certificate

Question

I'm trying to use PowerShell to extract a private key from a certificate stored in the personal store. This is an EV Code signing certificate that came with the key on a USB device.

Most of the tools I've found seem related to Local Machine certificates and are not working, and I hit on the steps in this post: https://hope.mx/2019/recovering-a-certificate-where-the-private-key-is-marked-as-non-exportable/

I tried to use those steps:

PS Cert:\CurrentUser\My> $a = Get-Item Cert:\CurrentUser\My\A0A0A0A0A0A0A0A0A0A0A0A0A0A0A0A0A0A0A0A0

PS Cert:\CurrentUser\My> $a.PrivateKey.CspKeyContainerInfo


MachineKeyStore        : False
ProviderName           : eToken Base Cryptographic Provider
ProviderType           : 1
KeyContainerName       : te-cd6cd72c-da9c-4862-b02d-419e7ac19123
UniqueKeyContainerName : te-cd6cd72c-da9c-4862-b02d-419e7ac19123
KeyNumber              : Exchange
Exportable             : False
HardwareDevice         : True
Removable              : True
Accessible             : True
Protected              : True
CryptoKeySecurity      :
RandomlyGenerated      : False

It was my understanding that I should be able to find that file under C:\ProgramData\Microsoft\Crypto\RSA, but it is not there and in fact none of the files in the RSA directories even start with "te-"

Does that value really represent the name of the private key file someplace in the system? If so, where?

Answer 1

Does that value really represent the name of the private key file someplace in the system?

Yes

If so, where?

$a.Thumbprint is the unique container where the key file is stored.

This corresponds to %APPDATA%\Microsoft\SystemCertificates\My\Certificates

This should be a good start to what you're looking for.

    #!/usr/bin/env powershell
$a = Get-Item -Path Cert:\CurrentUser\My\10EDAD11F3A6F39FBA5E38A2480D96979D33ABD0

$thumb = $a.Thumbprint
$path = "$env:APPDATA/Microsoft/SystemCertificates/My/Certificates/" + $thumb
Write-Output -InputObject $path
Test-Path -Path $path
& "$env:windir/system32/certutil.exe" $path

I've taken some info from here.

Answer 2

It is a token (hardware device) that was built to protect the private key - which means it shall not be exported. Sorry to say: You cannot.