install root certificate on disk image using platform builder?

imed-deborah

I have a web service that my mobile devices connect to over SSL. Obviously, the root certificate needs to be installed in order for the communication to work properly. I've done a lot of poking around, and there are ways such as this to get me started, and I can do some fun ugly MFC calls to things like CertAddEncodedCertificateToStore to get this to work. However, I'm hoping there's an easier way.

Here's my situation:

I have two models of custom Windows CE devices -- one with a screen, and one without a screen. No solution can involve user intervention such as clicking on a certificate or installing it through Explorer, because that won't work on the screenless models. We have a custom disk image put on the devices during the manufacturing process. Ideally, I'd like this image to include the certificate pre-installed.

Is there a way to find out what registry keys are created during certificate installation so that I can just put these in my disk image and have all my devices come out with the proper certificate pre-installed My poking around has revealed stuff in HKEY_LOCAL_MACHINE\Comm\Security\SystemCertificates\Root\Certificates containing keys with unreadable names (a GUID or some other naming scheme) with a value called Blob containing a bunch of data that is presumably the thumbnail value of a certificate or something similar.

Alternatively, if one could point me to a purely command-line program that installs certificates, I can integrate that into the device initialization software. Finally, if anyone has a good code example for using the Cert* functions, I'd appreciate that, because I could integrate it directly into my software. But my preference would definitely be to somehow just add it to the disk image so that it comes preinstalled. It seems as though it would be possible, given that some root certificates already come preinstalled in Windows CE.

Thanks,
Deborah

Peter Nowak (Germany)

Hi,

I would suggest you post your question in the Windows Embedded CE forum (http://www.microsoft.com/windows/embedded/eval/wince/default.mspx).

This looks like the appropiate forum for this question.

Cheers, Peter

imed-deborah

That's not quite the right place for the question, because we aren't actually using embedded CE, and parts 2 and 3 of my 3-part question (command-line utility, example source code) are still relevant to this forum if there is not a way to install the certificate automatically in the image.

There isn't really an analogous forum there to the ones here -- I'll keep looking and try to post there as well, but I still invite responses here to my other two questions.

Thanks,
Deborah

Michael Koster

Hi Deborah

You could be using the old Pocket PC 2002 'AddRootCert.exe' sample as a base for your own command line utility.

You can find the tool here: http://support.microsoft.com/default.aspx/kb/322956

Hope this helps

Michael

imed-deborah

Thanks -- I'd seen that and was hoping to avoid having to use something similar.

I think I've stumbled across what I was looking for. The document here talks about adding a certificate to the system store essentially at build time. When one is an oem manufacturer (i.e., builds and image using platform builder), one can have a custom file PKCS #7 file that enumerates the trusted authorities to add to the system store. The first time the machine tries to use any certificate stuff, it will load that file and then delete the registry key that tells it where to look for the initialization file.

I'll post again when I've figured out exactly how to make/edit the .p7b file to include my server root certificate so that it trusts my server out of the box and is able to communicate to a web service on it over SSL without any user intervention.

Deborah

Michael Koster

Hi Debotah

If you're able to build your own OS image - yes this is the way to go.

You could be using the Windows 'Certificate' MMC Snap-in (certmgr.msc) You'd basically import all root certificate you want on your device to the 'Personal' store. Then select all certs and export them as a p7b file. this and this article should help to get the job done.

Michael

imed-deborah

Yes, that's exactly what I ended up doing. I opened up the certificate snap-in in mmc and imported sysroots.p7b, which is the default set of trusted roots, into my Personal store, which had started out empty. Then I imported my server certificate. Then I selected all of them and exported them to a .p7b file.

This caused my server to be trusted without any intervention and allowed it to connect to the web service with no problem.

Hooray!

Deborah