Question

I’m looking for a way to get all system certificate stores, in any location (CurrentUser or LocalMachine).

The StoreLocation enumeration clearly won’t include user-defined certificate stores created with X509Store(String) or X509Store(String, StoreLocation). Also this doesn’t define other standard stores such as SPC or Request.

I’ve looked at the crypto32.dll API and I couldn’t see anything relevant in there apart from register/unregister.

Non file-system based stores appear in the registry (eg HKEY_CURRENT_USER\SOFTWARE\Microsoft\SystemCertificates\Root). The PowerShell Certificate Provider can interrogate stores. Is this — querying the registry — what it’s doing under the hood? Would such a hand-rolled solution be portable between XP/Vista/7/8?

Answer 1

Well, our SecureBlackbox product does what you need via CryptoAPI, namely CertEnumSystemStore() function. It has plenty of parameters, though.