How to intercept the use of an A1 certificate in a C# desktop application

Question

I am developing a business application that manages the company's certificates for security purposes. However, I was asked to add an extra layer of security due to some internal issues. To address this, it was requested that, before the certificate is consumed by the web browser, an OTP (One-Time Password) is required to ensure that the user accessing it is authorized.

I am confident about the OTP implementation part, but despite thorough research, I couldn't find any resource that allows me to intercept this process. Is it truly not possible, or is there something that can assist me in achieving this?

Answer 1

Hi @Yuri Augusto Da Costa , Welcome to Microsoft Q&A,

There are two relatively direct methods.

One is to use Windows API Hook to intercept the CertOpenStore call of the certificate store, and prevent the certificate from being read before the user passes the OTP verification. This requires the use of API Hook technology, which may have compatibility issues. It directly intercepts certificate access and can forcibly block requests that are not OTP authenticated. It can be applied to all applications that use certificates.

One is to only intercept the C# application developed by yourself, and you can manually verify the OTP when loading the certificate, and then decide whether to use the certificate.

Best Regards,

Jiale

---

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". 

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.