certificate

[longrob]

Hi

I have XP Pro x64 and I'm about to upgrade to Win7 Pro 64 bit.

I am a little worried about what will happen to one security certificate that I use daily to access a particular website. I have Windows Easy Transfer installed. If I use this, will the certificate be copied accross properly into Win7 ?

The certificate in question appears in the Certificates snap-in in MMC under
Certificates - Current User - Personal

Thanks
LR

 

[sup3rsprt]

you can export your certificates. Do that before upgrading. Then import it after.

 

[longrob]

Ahh. OK. Thanks !

 

[sup3rsprt]

You're welcome

Also, and this may go without saying but... make sure you export it to a safe location. Don't export it to a drive you're going to format or install Windows on. You can also password protect it if I'm not mistaken.

 

[longrob]

Hi again

I've now installed win7 and imported the certificate. However it doesn't seem to have worked correctly. When importing, I selected "personal" (it was a personal cert on my xp machine) and the import says it was successful, but it does not appear in the "personal" store - it appears in the "other people" store.

I am now unable to access the website I need it for. I have tried to delete it, but it said I do not have permission to do so (!!) and I also tried re-importing it, but the exact same thing happened.

Please urgently advise

Thanks again
LR

 

[zigzag3143]

Hi again

I've now installed win7 and imported the certificate. However it doesn't seem to have worked correctly. When importing, I selected "personal" (it was a personal cert on my xp machine) and the import says it was successful, but it does not appear in the "personal" store - it appears in the "other people" store.

I am now unable to access the website I need it for. I have tried to delete it, but it said I do not have permission to do so (!!) and I also tried re-importing it, but the exact same thing happened.

Please urgently advise

Thanks again
LR

Are you logged in as admin when trying to delete it?

 

[sup3rsprt]

It sounds like you didn't export the private key along with the cert.

A certificate is composed of public and private keys. You can't decrypt or sign messages without a private key.

 

[longrob]

Yes I think so - Under "Make changes to your user account" it shows my account name, and below it says "Administrator" and below that "Password protected"
If I click on "Manage another user account" the only other account present is "Guest"

 

[longrob]

It sounds like you didn't export the private key along with the cert.

A certificate is composed of public and private keys. You can't decrypt or sign messages without a private key.

That rings a bell. When I exported it I noticed an option to export the private key, but it was greyed out and there was a note saying something like "the private key for this certificate cannot be exported".

 

[sup3rsprt]

Hmm. Yes that's the problem then.

Who issued you that certificate in the first place? Can you get another one?

 

[longrob]

Hmm. Yes that's the problem then.

Who issued you that certificate in the first place? Can you get another one?

Herein lies the exact problem I wanted to avoid in the first place. The cert was issued by a bank in a foreign country (for internet banking). The only way I can get a new one is that they send it to my address by physical mail (also in the foreign country). Not only is there no one at the address to receive it and send it to me, but I can't even contemplate the delay caused by having to fly to the other country to get it in person (let alone the cost of doing so).....

Is this a hopeless situation ?

I'm not much of an expert in these matters (as you can obviously deduce), but do you think it's possibe to recreate the cert ? I have the original "code" they sent me. When I installed it, I just had to click a button on their website, enter some login details and at some point enter the code they sent (which I still have). Is this code likely to be somethig that can only be used once and if I try to use it again, it will fail and possibly lock me out alltogether ? The only other solution I can contemplate is rolling back to winXP - the last thing I did before upgrading to win7 was to do a backup.

LR

 

[sup3rsprt]

the last thing I did before upgrading to win7 was to do a backup.

Smart man.

Yes, you could try to create a certificate at the website. Contact support first if possible.

 

[longrob]

the last thing I did before upgrading to win7 was to do a backup.

Smart man.

Yes, try to create a certificate at the website.

You mean, don't restore the backup *yet* - try to recreate the cert first in win7 ?

What scares me to death about that is, if for some reason that doesn't work AND it also results in my login being locked out alltogether then restoring my XP backup will be fruitless too. I've spent about 48 hours upgrading to win7. If I go back to xp and *still* can't use the website, it will be complete debacle.

Obviously no one here can give me any guarantees, but is it plausible it's a "one-time-only" kind of thing ? It sounds a bit harsh as it would completely preclude someone upgrading their computer, and still being able to access the website, right ? I wouldn't put it past a bank to do that, but is there any *standard* ways that these things work ?

Thanks again
LR

 

[sup3rsprt]

I edited my message to say "contact support first if possible".

Normally you would have to get your certificate revoked in order to get issued a new one.

 

[longrob]

OK, thanks for your replies.

It seems I'm faced with 2 choices:
1. Roll back to winXP.
2. Attempt to recreate the cert with this bank's website using the "code" they sent me before.

My fear is that if I try 2, and it fails I might be precluded from trying 1 .Meanwhile, the time I've invested in the upgrade makes me reticent to do 1 first. A connundrum.

Is it possible that this "code" they gave me a few months back is for "one-time-use" ? Would that be normal or not ? Given that I was unable to export the private key it would seem likely that it's not for one time use, otherwise it would mean anyone upgrading their PC would need to get a new cert. Or maybe that's the way these things normally work ?

Sorry, I realise I'm asking for speculation.

LR

 

[sup3rsprt]

It might be that when you first installed the certificate, you didn't mark the private key as exportable. It could explain why the option to export it was "grayed-out".

If you can't contact support or find any information on the site about getting a new cert, maybe rolling back to XP is the safest option.

If you create a new partition on your hard disk, you can install XP without having to completely wipe out your Windows 7 install.

Another option is to install something like Virtual PC and/or XP Mode. Running XP in a virtual machine will allow you to keep Windows 7 intact.

 

[longrob]

Thanks again.

For Virtual PC and/or XP Mode, would I have to run them on this physical laptop ? I don't have enough free disc space and the laptop can't boot from an external USB drive. But I'm wondering if I might be able to run Virtual PC and/or XP Mode on a different machine alltogether, and restore my backup onto that ? I have access to several other PCs.

Many thanks for your help on this !

LR

 

[sup3rsprt]

What kind of format is your XP backup?

But I'm wondering if I might be able to run Virtual PC and/or XP Mode on a different machine alltogether, and restore my backup onto that ?

"XP Mode" requires Windows 7 and a processor with virtualization support. However it is still possible to use products like Virtual PC, VMWare, Virtualbox, etc. to run Virtual Machine within other operating systems and processors which do not support virtualization.

 

[longrob]

What kind of format is your XP backup?

But I'm wondering if I might be able to run Virtual PC and/or XP Mode on a different machine alltogether, and restore my backup onto that ?

"XP Mode" requires Windows 7 and a processor with virtualization support. However it is still possible to use products like Virtual PC, VMWare, Virtualbox, etc. to run Virtual Machine within other operating systems and processors which do not support virtualization.

My XP backup was made with the XP (x64 SP2) backup utility to an external USB HDD. It's a full backup of the C: drive made a few days ago plus an incremental backup made just before with win7 upgrade. Both files have .bkf extensions.

I have an XP Pro and an XP Home PC available to me if necessary.

Thanks again...........

 

[sup3rsprt]

Well, the good news is that ntbackup certainly backed up your files. However I can't say how easy or difficult it will be to recover the private key.

Can you open .bkf files in Windows 7?