C# - Use of A3 Certificate (Card Reader) + Windows Service

Question

Good morning to all.

I created a windows service (C#) where I sign XML from NFC-es using Flexdocs DLL. Using A1 certificate everything works normally, but when using A3, the frame where I must enter the PIN (password) does not open/appear.

I tried to inform myself via web, on this subject and what I could raise is that, the windows service does not open the frame because it has no user interaction. I then tried to pass the PIN directly, but still could not.

I come desperately here to ask: Is there any way to use A3 Certificate + Windows Service? So it’s 100% automatic? Or at least pass the PIN via code??? The objective is simple, the service monitor the information of the coupons in the BD and with this generate/sign/send/fetch XML.

I will pass on all the information I have so far:

1) The card reader is from Serasa Experian, model: "Near CCID";

2) Using A1 certificate (installable file) worked 100%. The only difference is that I had to change the service to log in as the current user of the machine (If possible I wish it did not have to be done, but as "system account" or "local service account" does not work the certificate):

3) Via Debug in Visual Studio, the A3 certificate opens the frame for typing the PIN, but testing the installed service, it does not open the PIN frame and returns: 5002 - Error: Connection Failure: Windows Error=[Message The request has been cancelled: It was not possible to create a secure channel for SSL/TLS. ] (Probable cause: the web service certification chain accessed or the client certificate not found in the current Windows user certificate repository);

4) I tried to pass the PIN straight as explained here, using the "Rsacryptoserviceprovider" class but giving "denied access". In the code where is "xxxx" => PIN. The code line which denied access error => enterprise.X509certificate.Privatekey = test;:

X509Store store = new X509Store(StoreName.My, StoreLocation.CurrentUser);
                store.Open(OpenFlags.ReadOnly | OpenFlags.OpenExistingOnly);

                //if (store.Certificates.Count == 0)
                //{
                //    store = new X509Store(StoreName.My, StoreLocation.LocalMachine);
                //    store.Open(OpenFlags.ReadOnly | OpenFlags.OpenExistingOnly);
                //}

                X509Certificate2Collection collection = (X509Certificate2Collection)store.Certificates;
                X509Certificate2Collection collection1 = (X509Certificate2Collection)collection.Find(X509FindType.FindBySubjectDistinguishedName, empresa.Certificado.ToString().Trim(), false);

                if (collection1.Count == 0)
                {
                    throw new Exception("Não é possível continuar, Certificado Digital não encontrado!");
                }
                else
                {
                    empresa.X509Certificado = collection1[0];
                }

                RSACryptoServiceProvider teste = new RSACryptoServiceProvider();

                teste = LerDispositivo("xxxx", 1, "SafeSign Standard Cryptographic Service Provider");

                empresa.X509Certificado.PrivateKey = teste;

Any Help will be welcome, if you need more information, please ask me! Thank you all!

Answer 1

The use of the A3 type certificate is more restricted than the A1 type. In A1, you can open it within the code if you have the private key password. A3 requires the user to enter the password when requested by the application.

When you debug the service in Visual Studio, it is actually running as a Console and the certificate "driver" will show the screen to enter the PIN. But when it becomes a real Windows Service, the "driver" won’t let you use the certificate.