Details
-
Suggestion
-
Resolution: Unresolved
-
Not Evaluated
-
None
-
5.15, 6.8.0
-
None
-
Windows with schannel backend
Description
For server applications we need to set local certificate and private key on QSslSocket. When using schannel on windows those are typically already in the windows cert store.
Instead of adding code to read out cert/key from windows cert store, convert them to DER, and then set them so that internally the QT implementation can generate a CERT_CONTEXT from it it would be better to provide a way to set CERT_CONTEXT* directly. See "localCertContext" in acquireCredentialsHandle.
This would also be a (the only) solution to support "non-exportable private keys" - which can be accessed by schannel but cannot be read-out/imported. With schannel there is really no need to have the private key in application memory, this is also a security issue.
See
https://forum.qt.io/topic/159800/qt-5-qnetwork-schannel-with-non-exportable-private-key
Error code "NTE_BAD_KEY_STATE" in
[CryptExportKey function (wincrypt.h) - Win32 apps | Microsoft Learn|https://learn.microsoft.com/en-us/windows/win32/api/wincrypt/nf-wincrypt-cryptexportkey]