Where are certificate private keys stored in Windows 7?

Question

Using the certmgr.msc utility, I can access the windows cert store, but I still can't figure out where Windows stores the private keys.

For example for a given certificate, Windows tells me that there is a private key associated with this certificate. But where I can I physically find it ?

Solution

The keys are stored via Microsoft's Cryptography API: Next Generation (CNG).

Storage locations:

• User private:
  %APPDATA%\Microsoft\Crypto\Keys
• Local system private:
  %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\SystemKeys
• Local service private:
  %WINDIR%\ServiceProfiles\LocalService
• Network service private:
  %WINDIR%\ServiceProfiles\NetworkService
• Shared private:
  %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\Keys

Description:

CNG provides a model for private key storage that allows adapting to the current and future demands of creating applications that use cryptography features such as public or private key encryption, as well as the demands of the storage of key material. The key storage router is the central routine in this model and is implemented in Ncrypt.dll. An application accesses the key storage providers (KSPs) on the system through the key storage router, which conceals details, such as key isolation, from both the application and the storage provider itself. The following illustration shows the design and function of the CNG key isolation architecture.

Source

Note:

As noted by Tim G, the keys are not readable at file level because they are encrypted in the process of storing them via the CNG API.

Comments

[Tim G]

These key locations are correct, but I have one point of emphasis/clarity: Windows Key isolation services obscure the keys, so they are not readable at the user or Administrator level from within the operating system as-is. (They are visible as files in Explorer, but you couldn't dump their true contents in a hex viewer or as ugly ASCII in notepad -- it would still be ugly ASCII, just not the true representation like in Unixoid systems.)

[Martin Bonner supports Monica]

@TimG Can you point me at any documentation which describes that obscuration? (I realize it's a bit late, but I can hope...)