certificate

[longrob]

Well, the good news is that ntbackup certainly backed up your files. However I can't say how easy or difficult it will be to recover the private key.

Can you open .bkf files in Windows 7?

The bkf files are not recognised in win7........

 

[longrob]

sup3rsprt , Just wondering if it might be possible to change the status of this thread to be unsolved so that it might get wider attention.......no disresprect intended whatsoever !

 

[sup3rsprt]

If 7 can't open it then I suppose you'll have to try restoring that backup on an XP computer or virtual machine. And we'll go from there.

sup3rsprt , Just wondering if it might be possible to change the status of this thread to be unsolved so that it might get wider attention.......no disresprect intended whatsoever !

Sure thing. I think Barman58 took care of it for us.

 

[longrob]

I've never had to restore a backup before.

I'm thinking of just using a new HDD in this laptop, re-installing XP and then restoring the backup.....

.....Will it just restore over the top of the existing XP install ? Is there anything special I need to do ? Is there a way I could just restore the certificate from the backup ?

 

[longrob]

More generally, supposing I manage to revert back to XP, is there any way I can get the certificate into win7, given that the option to export the private key was not available when I backed it up ?

When I originally installed the cert, I was given an alphanumeric code. That wouldn't be the private key by any chance would it ? [please excuse my ignorance]

 

[sup3rsprt]

Is there a way I could just restore the certificate from the backup ? is there any way I can get the certificate into win7, given that the option to export the private key was not available when I backed it up ?

Private keys are stored here:
c:\Documents and Settings\%username%\Application Data\Microsoft\Crypto\RSA

Public keys and certs are here:
c:\Documents and Settings\%username%\Application Data\Microsoft\SystemCertificates\My\Certificates

The problem with private keys is that they are encrypted by a Data Protection API. So in order to recover a private key you will probably need to get the machine as close to the original state as possible.

You may want to read up on the DPAPI to see what I mean. Particularly,

Example: Certificates and Private Keys

+

You Cannot Access DPAPI Confidential Information After Reinstalling Windows on a Stand-Alone Computer

+

Guidelines and Best Practices
* Export and back up important certificates and private keys to a safe and secure location.

 

[longrob]

Thanks again.

Does it mean I can just copy from one machine to the other once (if) I get it back in the original state ?

I've just bought a new HDD to install XP so I'll also have the win7 install if this problem can be resolved.

Another problem I have is that I don't have my original XP x64 installation disc or recovery discs, so I'm going to try doing a clean install of 32 bit XP (for which I have the cd) and then restoring my x64 backup. Hope it works (quite worried about it). I'll be offline for an hour or so doing that, so I'll check back here with an update then.....

 

[sup3rsprt]

Does it mean I can just copy from one machine to the other once (if) I get it back in the original state ?

I doubt that it is going to be as simple as copying files from one machine to the other.

Another problem I have is that I don't have my original XP x64 installation disc or recovery discs

You can download the 64-bit trial from Microsoft here:

http://www.microsoft.com/spain/windowsxp/64bit/evaluation/trial.mspx

(Unfortunately, the trial doesn't seem to be available on the English site any longer. If you need help translating use Google translate.)

 

[longrob]

Does it mean I can just copy from one machine to the other once (if) I get it back in the original state ?

I doubt that it is going to be as simple as copying files from one machine to the other.

I had a quick look at the links you provided, and from my limited understanding, it would seem to be impossible. Am I missing something ?

Another problem I have is that I don't have my original XP x64 installation disc or recovery discs

You can download the 64-bit trial from Microsoft here:

http://www.microsoft.com/spain/windowsxp/64bit/evaluation/trial.mspx

(Unfortunately, the trial doesn't seem to be available on the English site any longer. If you need help translating use Google translate.)

Thanks. Just downloaded it. I tried the 32 bit route and that was a complete failure !

 

[sup3rsprt]

from my limited understanding, it would seem to be impossible. Am I missing something ?

I don't think it is impossible. Just difficult.

You have a backup of your original installation, so everything needed to recover the cert must be there.

 

[longrob]

OK
progress update.
I downloaded the x64 trial. I didn't get any patches or updates. Then I restored my own x64 backup with "replace all files" and "to original location".
However, although all my apps have been restored, the old user accounts have not been restored. It logs on only as the admin account I created during the new install. No other user accounts are available. The folders for the user accounts have been restored, though I can't seem to locate the paths you mentioned where the keys are stored. using the Certificates MMC snap in, I can't find the needed certificate, and needless to say it doesn't appear in internet explorer Tools/Options/Content/Certificates

Note also that when I earlier tried 32 bit xp first, after restoring the x64 backup the error I got was that \system32\ntoskrnl.exe was missing, which it was, which made me wonder if all the necessary system files had been backed up.....

This is really a nightmare. But thanks for your advice !!!

LR

 

[longrob]

Excuse me. I *have* found the paths you mentioned where the public and private keys are stored. After the restore, the folder for that user was not available - poermission denied (for the new admin account) so I checked the backup contents directly and found them there, so then I restored them seperately without keeping the security settings....

But there is still only the new admin user that can log onto it.

I think there's a big time difference between us. Its 1.30AM here now and I'm going to get some sleep. If you have some suggestions or ideas for me to work on in the morning I'd be most grateful, but I won't be replying here for at least 6-7 hours (assuming I can get to sleep !!!!)

Thanks again.

 

[sup3rsprt]

You could try extracting all of the files from the backup using the restore wizard. But instead of restoring to "original location", restore them to an "alternate location".

Then boot from a Windows XP CD or something like UBCD4Win and copy over the files overwriting everything in the new XP install location.

If all goes well you should be able to login using your old account.

 

[sup3rsprt]

Did you do a system state backup?

I'm afraid that my above recommendation might not work if you didn't.

Show me the contents of Windows\System32\Config\ (from the backup)

 

[longrob]

Hi again

Thanks for those suggestions, but I decided to have the cert revoked and reissued. Swapping HDDs in and out of a laptop every couple of hours for 2 days is not very enjoyable (!!) At least I can move forward with win7 this way ! When I get the new cert I will pay attention to the option of allowing the private key to be backed up.

I'm also quite concerned that I was unable to easily restore what I thought was a full backup. The point is rather mute now since I (hopefully) am rid of XP for good, but I definitely want to avoid any similar problems with win7. I understand the backup utility is much better now and I'll be investigating that in the coming days.

I've been busy most of the day trying to configure windows live mail, eventually I had to remove it from the system - all manner of problems ( which I won't go into) encountered with importing messages from OE5.. Suffice to say that I've removed Windows Live from the system and have managed to get thunderbird up and running quite easily and with all my old (10 years worth) of emails.

Thanks again.
LR

 

[sup3rsprt]

Thanks for those suggestions, but I decided to have the cert revoked and reissued.

You mean you could have done that all along? :shock:

I'm glad you got it sorted out.

 

[longrob]

Thanks for those suggestions, but I decided to have the cert revoked and reissued.

You mean you could have done that all along? :shock:

I'm glad you got it sorted out.

Yes, I could have done that from the beginning, but the reason I didn't is that once it is revoked I have no access to the site and I have to wait for the new cert. This delay is a big problem, and that's why I went through hell trying to get the original cert back.

 

[longrob]

OK, this saga continues.

I have received the new certificate password.

After logging on to the site, it momentarily displays a page which I remember as being the one where the the password text had to be input, along with drop-down box and a message alongside saying to choose the option labelled "Microsoft enhanced cryptographic Provider v1.0", though the drop-down list appears empty. This screen only appears for around a second before being replaced with a screen with the simple message "Please make the correct browser setting first in order to install your certificate" (this is my tranlsation - it's in foreign language)
Unfortunately there is not information on the website about what the "correct" browser settings are !

Any suggestions ?

 

[longrob]

I have good news. I installed it on an XP machine, exported it, then imported into win7 and now everything seems to work. Phew.

Thanks !