CSP

This entry will enable/disable usage of both key set types for internal key container format. Some CryptoAPI applications will not check for correct values in the certificate store instead assume the key type.

Default value is 0; only correct key set may be retrieved.

This entry specifies a list of issuers which will be registered in user store for CryptoAPI, use ; to separate different issuers. Default none, all certificate are registered.

This entry can be used to limit extended usage for duplicate certificates. Specify object identifier for the extended usages that should be allowed, separate with ';'. Use text string <none> to allow nothing. Default empty, no special handling for duplicate certificates.

This entry can be used to enable/disable writing of certificate/container information to a cache file. The cache is used by Credential Provider when it is used in pass-through mode. Microsoft has some limitations regarding multiple access, so this is used to avoid extra access from the Credential Provider towards the CSP when used with Microsoft Provider.

Default value is 1; certificate information is written.

This entry is used to sort certificates for CSP via PP_USERCERT_STORE.

This entry will enable or disable clear of user PIN cache by the internal certificate propagation service.

Default value is 2; will clear user PIN cache for all users.

This entry specifies a list of applications, separated by using ;, that will have their own PCSC connection from CSP.

Default none; no applications will be handled.

This entry specifies the name format of the container representing certificates and corresponding private key.

Default value is 0; 'thumbprint (slotid)'.

This entry will enable/disable deletion of old key set when generating a new key.

Default value is 0; will not delete key set.

This entry specifies a list of issuers which will not be registered in user store for CryptoAPI, use ; to separate different issuers. Default none; all certificates are registered.

This entry will enable/disable showing of insert card dialog when requested smart card is not present.

Default value is 0; will show insert card dialog when needed.

This entry will try to enable/disable use of non-repudiation certificates for Microsoft CryptoAPI.

Default value is 1; will try to disable use of non-repudiation certificates.

This entry will enable/disable use of Net iD CSP for generating random values.

Default value is 1; will allow generating of random values.

This entry will enable/disable check of CRYPT_SILENT flag when creating new CryptoAPI contexts with CryptAcquireContext. Setting the CRYPT_SILENT flag when creating new CryptoAPI context means that the calling application will not allow the CSP to show any dialogs.

Default value is 0; will check silent flag.

This entry is used to enable/disable to storage of certificates in CryptoAPI user store.

Default value is 1; will register certificate in CryptoAPI user store.

This entry is used to register a friendly name for the certificate in CryptoAPI user certificate store. The following wild cards may be used:

Label is the certificate label stored with the certificate object, issuer and subject are any of the object identifiers available in the subject or issuer field from the certificate. Any combination of static text and wild cards above may be used.

Default value is "%subject.2.5.4.3% (%issuer.2.5.4.3%)".

This entry is used to initialize a change PIN dialog, when PIN is about to expire.

Default value is 0; no change PIN dialog.

This entry can be used to control installation of CA certificates to CryptoAPI store.

Default value is 1; will install CA certificates.

This entry can be used to enable/disable loading of Net iD Enterprise main library directly when the CSP is loaded. This may increase performance, but may cause unloading to be slightly slower.

Default value is 0; will not load external.

This entry is used to control loading and unloading of the CSP, when enabled the CSP library will not be unloaded. This was recommended by Microsoft for enhanced performance, but is no longer recommended by Microsoft.

Default value is 1; will load myself.

This entry is used to control the behavior of certificate storage when a smart card is removed. Normally certificates will be removed from CryptoAPI user certificate store when smart cards are removed.

Default value is 0; will not keep any certificates.

This entry is used to control the behavior of CryptoAPI contexts. Normally the PKCS#11 sessions will be closed as soon as the context is released, using this parameter will cause the session to be alive and wait for a new identical session. This behavior may increase performance.

It is also possible to specify a list of application names instead of 1, specified applications will have value 1 (all other 0).

Default value is 0; will not keep session alive.

KeepSessionAlive=iexplore.exe;lsass.exe

This entry is used as prefix for names when registered for smart card logon during installation.
Default value is empty; none.

This entry is used to control the behavior of registering certificates in CryptoAPI stores. Normally Net iD Enterprise always will try to register the certificates to Net iD CSP, even if another CSP already has registered the certificate.

Default value is 1; will overwrite certificate.

This entry is used to control the behavior of registering certificates in CryptoAPI stores. Normally Net iD Enterprise always will try to register the certificate both for the user and the machine. This will allow applications running in system environment to use the certificate.

Default value is 1; will try to publish in machine store.

This entry is used to control the behavior when writing certificates with the CSP. Normally we only write the certificate, but this parameter may be used to initiate a search for identical certificates and remove those if found. Identical means same issuer/subject/key.

Default value is 0; will not replace certificate.

This entry is used to when the container name has a special meaning for the calling application and needs to be used for future calls, i.e. Entrust. This will limit the use of secondary certificates and should be avoided.

Default value is 0; container name is automatically generated.

This entry is used to add a critical section for all CryptoAPI contexts. This should normally not be needed, since the same context should not be used by multiple threads simultaneously. It will also be possible to add a global critical section, this will only allow one single thread at each time to access the CSP.

Default value is 1; will add a critical section.

This entry will enable/disable validation of certificates before registration in CryptoAPI store. The validation is only made on the certificate value and signature if the CA certificate is available, no check is made regarding certificate revocation.

Default value is 0; will not verify certificate.