title: How to load Next Generation certificates from the Microsoft keystore using Java 8?
body: <p>I'm trying to load certificates directly from the Microsoft store in order to avoid having to export certs from the MS store and then import them into a JKS store.</p>
  
  <p>I managed to get certs created from a typical AD CS web server template using legacy crypto directly from the MS stores using SunMSCAPI.</p>
  
  <p>However, SunMSCAPI does not support the modern CNG ciphers I'm using, specifically RSA-2048 asymmetric encryption, SHA-384 hashing and ECDSA-384 digital signature.</p>
  
  <p>Is it possible to load Next Generation certificates from MS stores using Java? I'm on jdk1.8.0_45. Is there an off-the-shelf JCE provider alternative to SunMSCAPI that can handle CNG? I suspect it would have to use JNI or JNA to access the native Windows CNG API.</p>
  
  <p>I've tried <a href="https://pheox.com/products/jcapi/" rel="nofollow">Pheox JCAPI</a> without success. It supports RSA and DSA, but not ECDSA. I have not tried Bouncy Castle, but my understanding is that it does not offer such a capability.</p>
  
  <p>Are there other off-the-shelf JCE provider alternatives to SunMSCAPI that can handle CNG I could try?</p>
  
  <p>Update: <a href="https://pheox.com/posts/list/78.page" rel="nofollow">JCAPI v2 supports only RSA, ECDH support planned for v3 next year.</a></p>
  
  <p>Update: Some have suggested that installing the <a href="http://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html" rel="nofollow">Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files for Java 8</a> could perhaps resolve this, but no, that does not help, since the problem is that SunMSCAPI supports only RSA ciphers, as can be seen looking at the <a href="http://grepcode.com/file/repository.grepcode.com/java/root/jdk/openjdk/8u40-b25/sun/security/mscapi/SunMSCAPI.java?av=f" rel="nofollow">source code</a>.</p>