Windows Server 2003 PKI Key Archival and Recovery

Key Recovery
A PKI user or a PKI-enabled application's user typically initiates key recovery, which requires the intervention of at least one KRA (depending on the number of KRAs specified in the CA's properties). Windows 2003 PKI supports role separation—letting you separate the roles of CA administrator, certificate manager, and KRA—so key recovery might also require the intervention of a certificate manager to retrieve the recovery data from the CA database. The following examples assume no role separation and use only one KRA certificate. You can use the command line or a GUI to recover an archived private key.

A full Windows 2003 private key recovery sequence from the command line consists of the following steps:

1. The KRA identifies the user requesting a private key recovery.

2. The KRA records the user certificate's user principal name (UPN), common name (CN), account name (domain\username), Secure Hash Algorithm-1 (SHA-1) thumbprint, or serial number with the goal of finding a unique identifier by which to identify the key. If a particular user has more than one archived key, the safest method is first to retrieve a list of all archived keys. The KRA can use the following command:
   
   

   certutil -getkey <user CN, account name, or UPN>

   to retrieve a list of all archived keys for the user. This command returns the serial number of each archived key; the KRA can then identify the key to recover and use the corresponding serial number as a unique identifier.
   
   
3. To export the recovery data from the CA database, the KRA opens a command prompt and types

   certutil -getkey <unique identifier> <output file>

4. Next, to transform the output file to a Public-Key Cryptography Standards (PKCS) #12 file that contains the recovered private key and is secured by using the password test, the KRA types
   
   

   certutil -p "test" -recoverkey <output file> <PKCS#12 file>

   If the KRA recovers multiple keys for the user, the KRA can then merge the multiple PKCS #12 files into one PKCS #12 file by typing
   
   

   certutil -p "test" -MergePFX -user "<PKCS#12_file1>,<PKCS#12_file2>" "<NameofCombined_PKCS#12>"

5. The KRA provides the final PKCS #12 file to the user, who can import it to his or her certificate store.

To recover keys by using a GUI, the KRA must use the Microsoft Windows Server 2003 Resource Kit's Key Recovery tool (krt.exe—aka Certification Authority Key Recovery), which Figure 4 shows. To recover keys by using the Key Recovery tool, the KRA must perform the following steps: . . .