Chilkat使用CNG证书签名邮件问题：非导出证书解决方案需求

Great question! I've run into this exact issue with non-exportable CNG certificates in Chilkat before. The key here is leveraging Chilkat's built-in support for Windows CNG providers instead of relying on exported private keys. Here's how to make it work:

Prerequisite: Update Chilkat #

First, make sure you're using Chilkat v9.5.0.88 or newer—earlier versions have limited support for non-exportable CNG private keys. This update adds better integration with Windows' CryptoAPI for accessing CNG-stored keys.

Step-by-Step Solution #

1. Load the certificate from the Windows Store
   Use Chilkat's CertStore to access your personal certificate store (usually the "MY" store) and retrieve the target certificate. Make sure you're identifying the certificate correctly (by subject DN, thumbprint, etc.).

2. Unlock the CNG Private Key
   Non-exportable CNG keys are protected by Windows, so you need to explicitly unlock the private key associated with the certificate. If your certificate has a PIN, you can set it programmatically to avoid interactive prompts.

3. Assign the Certificate to MailMan
   Instead of using SetSigningCert2 (which requires an exported private key), use SetSigningCert directly with the unlocked Cert object—Chilkat will handle accessing the CNG private key under the hood.

Example Code (C#) #

// Initialize Chilkat components
var certStore = new Chilkat.CertStore();
var mailMan = new Chilkat.MailMan();

// Open the Windows personal certificate store
bool storeOpened = certStore.OpenWindowsStore("MY");
if (!storeOpened)
{
    Console.WriteLine($"Failed to open store: {certStore.LastErrorText}");
    return;
}

// Retrieve your CNG certificate (adjust the subject DN to match your cert)
var signingCert = certStore.FindCertBySubjectDN("CN=Your Certificate Subject Name");
if (signingCert == null)
{
    Console.WriteLine("Signing certificate not found in store.");
    return;
}

// Unlock the private key (set PIN if your cert requires it)
signingCert.Pin = "YourCertificatePIN"; // Omit if no PIN is required
bool keyUnlocked = signingCert.UnlockPrivateKey();
if (!keyUnlocked)
{
    Console.WriteLine($"Failed to unlock private key: {signingCert.LastErrorText}");
    return;
}

// Configure MailMan settings (adjust SMTP details to your provider)
mailMan.SmtpHost = "smtp.yourprovider.com";
mailMan.SmtpPort = 587;
mailMan.StartTLS = true;

// Assign the signing certificate
bool certAssigned = mailMan.SetSigningCert(signingCert);
if (!certAssigned)
{
    Console.WriteLine($"Failed to set signing cert: {mailMan.LastErrorText}");
    return;
}

// Create and send your email as usual...
var email = new Chilkat.Email();
email.Subject = "Test Signed Email with CNG Cert";
email.Body = "This email is signed using a non-exportable CNG certificate.";
email.AddTo("Recipient", "recipient@example.com");
email.From = "Your Name <your@example.com>";

bool emailSent = mailMan.SendEmail(email);
if (emailSent)
{
    Console.WriteLine("Email sent successfully with CNG signature!");
}
else
{
    Console.WriteLine($"Failed to send email: {mailMan.LastErrorText}");
}

Troubleshooting Tips #

• Permissions: Ensure the user running your application has read access to the CNG private key. To set this:
  1. Open Certificate Manager (certmgr.msc)
  2. Find your certificate, right-click > All Tasks > Manage Private Keys
  3. Add the user account and grant Read permissions
• Verify CNG Provider: Check your certificate's properties (Details tab > Key Storage Provider) to confirm it uses the Microsoft Software Key Storage Provider
• Service Accounts: If running as a Windows Service, ensure the service account has access to the private key, and consider disabling interactive PIN prompts (use a certificate without PIN or configure auto-unlock)

内容的提问来源于stack exchange，提问作者JRack