How to suppress "An application is requesting access to a protected item" popup

Question

I'm getting a pop-up when trying to use a certificate to decrypt data. I'm creating a self-signed certificate, and I'm using it to encrypt some data, but I'm getting the following confirmation pop-up when trying to decrypt the data:

How can I programatically grant access to use the certificate?

Mccloskey

Answer 1

I believe the issue is that the certificate's private key has "strong protection" enabled.

Enable strong private key protection. You will be prompted every time the private key is used by an application if you enable this option.

Any attempt to use the private key causes Windows to display the warning.

You have to re-import the certificate without the Strong private key protection option enabled.

Group policy that does the same

It's also possible a system wide group policy is in effect:

• secpol.msc
  • Security Settings
    • Local Policies
      • Security Options
        • System Cryptography: Force strong key protection for user keys stored on the computer

System Cryptography: Force strong key protection for user keys stored on the computer

This security setting determines if users' private keys require a password to be used.

The options are:

User input is not required when new keys are stored and used User is prompted when the key is first used User must enter a password each time they use a key For more information, see Public key infrastructure.

Default: This policy is not defined.

If that group policy security option is set, you have to disable it.

Bonus Reading

• MSDN Blog: What is a strong key protection in Windows? (archive)
• Technet GP reference: System cryptography: Force strong key protection for user keys stored on the computer (archive)

tl;dr: You cannot programatically bypass a security boundary

Munafo

I've set "System Cryptography: Force strong key protection for user keys stored on the computer" policy to "User input is not required when new keys are stored and used", but I still get constant promots. Does anyone have the same problem? – Goss

@DenisMolodtsov Export the key, delete it from the store, re-import it leaving "Enable strong private key protection" unchecked. – Munafo

Thank you for the reply, @Ian. I've added the screenshot in the new answer, just in case someone is as dumb as me to mark the "Enable strong private key protection" checkbox. – Goss

Answer 2

Ian's answer is correct. I just want to add my 2 cents. I've installed the .pfx certificate with the "Enable strong private key protection" checkbox (see screenshot).

If this is done - then no policies will help you remove the prompts. I had to reinstall the certificate without this checkbox marked. Don't ask me why I marked it in the first place.

Goss

Helpful screenshot.. but to be clear, is your answer saying something different from Ian's? – Ralli

Yes, my answer is just an addition to what Ian already explained – Goss