RE: [EXT] Question regarding TLS Plugin (vw 9+)

In addition, the plugin does not appear to support Windows Service accounts<https://urldefense.com/v3/__https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/service-accounts-on-premises__;!!DZ3fjg!oehLAVhtr6OvI-IP624-qX8LJZ0AUnA_meFkGl3JaqkNDKFlvRFc9PHqv7MRVicTqeikMb8$ >?

From: [email protected] <[email protected]> On Behalf Of Philippe Demaecker
Sent: Friday, 15 April 2022 12:38
To: [email protected]
Subject: [EXT] [vwnc] Question regarding TLS Plugin (vw 9+)


Warning: This is an external email. Do not click on links or open attachments unless you recognize the sender and know the content is safe.
Hi list,

Our first customers are starting to use our application based on the new TLS plugin on Windows.

The current use case is a Sioux HTTPS server, which relies on a private key + server cert coming from the Windows certificate store. It looks like the TLS framework expects the priv key/server cert to be located in the 'Current User" Certificate store. However, I'm starting to doubt if this is correct. Following MS page: https://urldefense.com/v3/__https://docs.microsoft.com/en-us/dotnet/framework/wcf/feature-details/working-with-certificates__;!!DZ3fjg!oehLAVhtr6OvI-IP624-qX8LJZ0AUnA_meFkGl3JaqkNDKFlvRFc9PHqv7MRVicT2aljhgc$ <https://urldefense.com/v3/__https:/docs.microsoft.com/en-us/dotnet/framework/wcf/feature-details/working-with-certificates__;!!DZ3fjg!pY4gy0DS0oZOeAQf4qcDBzy-CCb2qwYVO0_aeP8caqeR7K1AiN8V5flj-KGqdc8EE6iKh4A$> states that:


  *   The local machine store. This contains the certificates accessed by machine processes, such as ASP.NET. Use this location to store certificates that authenticate the server to clients.
  *   The current user store. Interactive applications typically place certificates here for the computer's current user. If you are creating a client application, this is where you typically place certificates that authenticate a user to a service.


So I would expect Sioux server pk/certs to be retrieved from the local machine store, and certs used for client authentication to be stored in the current user store.

The Sioux/TLS documentation merely states that: "On MS-Windows platforms, the server certificate must already have been imported into the Windows Certificate Store" but does not specify which one...

Any advice/thoughts on the matter?

Thanks,
Phil.