How to copy a certificate from the registry to a flash drive. Instructions for copying digital signature from a floppy disk or flash drive to a Rutoken. What does a certificate export and why is it needed?

The most popular option for using digital signatures is this moment is a rutoken - this is a special flash drive on which the private key is written. The main difference between such a storage medium is that it contains a cryptoprocessor, with the help of which a public key is generated that is used to sign documents. How to use an electronic signature from a flash drive, what software will you need for this? Is a root token always necessary to sign the same documents?

On which flash drives can digital signatures be stored?

EDS can be recorded on the following flash drive options:

  1. Regular USB drive. This method use electronic signature not recommended, as stealing the certificate will not be a problem. Nowadays, practically no certification center provides services for issuing digital signatures and recording them on a regular USB drive.
  2. USB drive with secure storage. In fact, this is the same regular drive, but its internal memory is divided into several sections. And access to one of them, where the digital signature is stored, is password protected. This is enough convenient option, but the protection is moderate; stealing a signature will not be a problem for an experienced fraudster.
  3. USB tokens with a crypto processor. They are often called “Rutoken 1.0”. Their main drawback is that when installing a certificate into the system, it is the private key that is used, which can subsequently be stolen from the hard drive.
  4. USB tokens with digital signature generation function. Currently, this is the most advanced option for storing an electronic signature. They are often referred to as “Rutoken 2.0”. They have everything benefits of USB tokens with cryptoprocessors, but at the same time they are able to generate public keys “on the fly”, which are subsequently installed on the computer. In this case, it will not be possible to steal the certificate, since access to internal memory limited by hardware (data from a flash drive is accessible only to the cryptoprocessor), and is also protected by a secret key.

And when they now talk about flash drives on which digital signatures are stored, 95% of them mean USB tokens with the function of generating an open signature.

These are the ones that are now issued in all certification centers that offer an enhanced qualified signature.

To understand how documents are signed, you need to understand the digital signature technology itself.

  1. So, The private key is recorded on the Rutoken, accessed through secret code– it is available only to the owner of the digital signature.
  2. Using specialized software (for example, CryptoPro CSP) public key is generated– a copy of it is also stored in the certification center (in case of disputes regarding the authenticity of the certificate).
  3. When placing a signature on an electronic document, a small piece of information is added to the end of the file - open certificate data (can also be added as separate file). And when installing a certificate on a computer, a public key is generated (this is done through CryptoPro CSP).

How to work with a USB token

Expert opinion

Alexandra Stepanova

Digital signature selection consultant

How to use an EDS key on a flash drive? All operations are performed through a crypto provider, that is, special software that checks the relevance of the electronic signature used via the Internet. The only accredited program in the territory Russian Federation– this is CryptoPro CSP (currently it is allowed to use version 3.0 or higher).

Some operations with electronic signature are also performed through CryptoARM is a special plugin for browsers. Using this program, for example, access to the system is provided electronic trading(where government tenders are presented on accredited sites).

The recommended operating system for working with digital signatures is Windows, edition 7 or older. To work with electronic documents should be used Microsoft Office version 2007 or older (works in version 2003, but with certain limitations in functionality). As for the browser, the CryptoARM plugin works with all current web browsers, but experts recommend using Google Chrome latest version or Internet Explorer versions 9.0 or older.

Installing a certificate on your computer

Rutoken is physical device, which mechanical damage will not be a problem. If you use a flash drive every time you need to sign a document, the likelihood of its failure increases. There is an alternative to this - installing an open certificate in operating system. After this, you can sign the document without a root token.

So for EDS installations on your computer you need:

  • install CryptoPro CSP current version;
  • run the program, go to the “Service” tab, click on “View certificates in the container”;
  • at the bottom of the window, select the certificate provider (CryptoPro);
  • insert the token into the USB port;
  • select “Find certificate automatically”;
  • Follow the on-screen instructions (you will need to enter your secret key).

After installing the certificate on the system, it is strongly recommended to restart the operating system for all changes to take effect. Afterwards, a new, just installed key will appear in the “View certificates in container” list.

Using a certificate from a drive

If in the future you do not plan to use a PC for periodic use of digital signatures, then you can sign a document without installing a certificate in the system. But you will still need the current version of CryptoPro CSP (3.0 or older).

How to use an electronic signature from a flash drive? If you just need to sign a digital document, then this is done as follows::

  • select “File”, then “Document Protection”, click on “Add Digital Signature”;
  • then select the required certificate in the dialog box (specify Rutoken as the source at the bottom);
  • complete encryption and save the signed document on your hard drive.

Please note that for CryptoPro CSP to work correctly in combination with Microsoft Office, the CryptoPro Office Signature plugin must be installed in the system (you can download it on the CryptoPro website for free).

There is no need to install the public key in the OS - it will be generated automatically by the CryptoPro program, after use the certificate is deleted, and a copy of it is not saved on the hard drive. In the same way, you can sign XML or PDF files from a flash drive (in the latter case, you will need a pre-installed Adobe Reader current version).

Using digital signature for trading

To work with digital signatures in a browser window, you need to install the CryptoARM plugin. It is supplied as a separate program (when installed, the plugin is integrated into all compatible web browsers installed in the OS) and as a plugin for a specific browser. After installing CryptoARM, you must restart your browser!

In electronic EDS bidding is necessary to confirm applications for participation in auctions or to submit a request for bidding. Here everything happens automatically - the site independently turns to CryptoARM when it needs to verify a user request using an electronic signature. Next, the CryptoPro dialog box appears (the browser may prompt you to launch third-party software), where you should select the root token inserted into the USB as the signature source. Further generation of the public certificate and identification of the individual is performed automatically.

In a similar way, you can work with digital signatures on a flash drive and on other sites that use identification or login to the portal through electronic signature verification. These, for example, include sites from the list of State Services, the Federal Tax Service portal for submitting financial statements in electronic form.

So, how to use digital signature from a flash drive? All that is required for this is an installed and activated version of CryptoPro CSP versions 3 and older, as well as plugins for Microsoft Office or browsers (depending on the purpose for which the root token is used). However, it is still recommended to install the certificate in the OS so that you do not have to use a USB token every time. But even if it is disabled, it can be replaced through a certification center (in this case, a new digital signature is issued, the old one is canceled.

To perform any actions on the digital signature, copy the digital signature, delete or install it, you need the CryptoPro program installed on your computer.

  1. In order to copy the digital signature, you need to go to Start-All Programs-CryptoPro and run the CryptoPro CSP file.
  2. Next, go to the Service tab.

  1. Click on the “Browse” button.

  1. Select the required container and click “OK”.

Note:

In the image above, you can see the presence of two columns: On the left is the “Reader” column and on the right is the “Container Name” column. This information will help you decide which digital signature to copy.

The inscription “Register” in the reader column means that the digital signature is on the computer. Otherwise, the digital signature is located on some medium (flash drive, floppy disk or secure media). In the case shown in the image, there are three digital signatures recorded on the computer and one signature recorded on Rutoken.

You can understand which certificate you need to copy by looking at the “Container Name”. The “container name” is made up of serial number, date of issue of the certificate and name of the organization.

In the case we are considering, we choose the digital signature located on the protected Rutoken media.

  1. Select and copy the container name, click “next”.

  1. Paste the container name copied in step 5 into the “Name” field key container”, add any few characters or spaces and click the “Done” button.

  1. Next, we need to select the location where we want to copy the digital signature. This could be a computer, flash drive or secure media. And click ok.

Note:

In the case we are considering, we copy the digital signature to a flash drive by selecting its name in the list of devices. If you need to copy your digital signature to your computer, you should select “Register” from the list of devices.

  1. Next, the system will ask you to create a password for the container. If you do not want to create a password, then leave the fields blank, as shown in the image. And just click “OK”.

This completes the digital signature copying.

Sometimes situations arise when you need to install a certificate with a key on another computer or make it backup copy. When working with USB flash drive We can make a working copy private key available using Windows, the main condition is the presence of CryptoPro CSP 3.0 installed.

Next, you need to follow the proposed instructions step by step, but it is worth remembering that a copy can only be made through a cryptographic information protection tool (cryptographic information protection tool), otherwise, for example, if you copy through Explorer, you will not be able to run the key on another computer.

Instructions for copying a certificate via CryptoPro CSP

1. Click on the CryptoPro CSP 3.0 shortcut or open it through Start – Control Panel.

2. In the system window, go to the “Equipment” tab and configure readers by selecting from the list of installed readers, then “Add”. Use "All removable drives" and "Register" if they were not on the list.

4. In the next window that opens, run the “Browse” command in order to enter a name in the empty field. When choosing a name, first confirm the operation, and then click on the “Next” button. In some cases, when working with a root token, you may need to enter a password (PIN code) - enter the sequence 12345678.

5. Create a name for the container where the data is copied. The keyboard layout can be either Russian or Latin. Spaces are also allowed in the name. After defining the name, click "Done".

6. Then the system will ask you to insert a blank key carrier, to which the container will be copied. Do this and click “OK”.

7. On the copy being created you can set a password - this is an optional step, so you can simply click “OK”, leaving the field empty. If the copy is made to a root token, then again you need to enter the standard security combination - 12345678.

The copying process will be completed when the system returns to the “Service” tab on the screen.

When transferring electronic reporting to another computer or reinstalling an encryption program, you need to copy electronic signatures. IN step by step instructions We show how to correctly copy electronic signatures through the ViPNet CSP program.

Step-by-step instructions on how to copy an EDS certificate

Step 1. Open VipNet program

Most likely you won't find the shortcut on your desktop. To open the program follow four steps:

  1. Go to menu "Start"
  2. Open item "All programs"
  3. Find the folder named "ViPNet"
  4. Click on the icon with the name "ViPNet CSP"

The VipNet encryption program will open.

Step 2. Open the electronic signature for copying

On the left side of the window that opens, go to the tab "Containers". A list of electronic signatures that are on your computer will appear.

Select the electronic signature to copy from the list. Click on the button "Copy".

Step 3. Select a location to copy the electronic signature

The system will prompt you to select the directory into which the signature will be copied. Click on the button "Review".

In the window "Browse folders" indicate the location for copying the electronic signature. Then click "OK".

Attention! The directory into which signatures are copied must not be named infotecs or containers, if you plan further complete removal ViPNet CSP.

Step 4. Copy the electronic signature

In some cases, the system will ask for an electronic signature password. Enter it and click OK.

The electronic signature has been copied.

My new post will be devoted to the Crypto Pro program, it seems to be nothing complicated, but all the time I have problems with this software, either because I have to deal with it once or twice a year or because the software is like that, but in general I decided to make a reminder for myself and for you.

Task: Provide access to the Kontur Extern program on two machines, OK, let's get started.

What we have: One already working key on the SD card.

What you will need: We need any media SD card, a USB flash drive can also be uploaded to the registry, or you can use the so-called RUtoken. I will install on RUtoken, and you can use any of the options.

Yes, just a small note, if you have a domain computer, it is better to do all this under the administrator account.

And so let's get started

Find the program in the start menu or control panel,

Let's launch the program.

Go to the tab Service and press the button Copy.

You will be required to enter a password of any 8 characters. Enter the password and press Further.

In the next window, we need to set the name of the container (I always use the one that is convenient for me; we have 2 organizations and I use the name-01 and 02 markings; you can also use the organization’s TIN for separation.) and then click the button Finish.

Here you will once again need to enter the password for the new container, make the same one and click OK.

In the next dialog box, you need to select the media where to copy our container, I select RUtoken and you need to select the media where you are going to install the container.

Once you have chosen, click the button Further. Then Finish.

That's basically it, the key has been copied. All that remains is to install it for a specific user.

There are two options here:

Option 1.

Go to CryptoPro again, open the service tab and click on the button View the certificates in the container.

In the dialog box that opens, open the container we need and click the button OK. then press the button Further.

In the next window, click the U button become, if it is not there, press button C troops.

In the window that opens, click the U button install a certificate. The certificate import wizard will open where you need to click Further.

In the window that opens, you need to leave everything as it is and click Further.

If the certificate is installed successfully you should see the following dialog box.

Option 2.

Installation via the menu install a personal certificate.

To install the certificate, we need the certificate file itself (a file with the extension .cer) it is located on the media where we copied it, in my case it is rutokin.

And so, open CryptoPro again and go to the tab Service and press the button Install a personal certificate.

In the window that opens, find this certificate by clicking on the button Review.

In the next dialog box, check the box next to Find container automatically, after which the program will automatically find the container you need. Then click the button Further.

Then a window may appear asking you to select the storage location for the certificate; you need to select Private and click the button OK.

Then a dialog box may appear where you need to click a button Yes.

Then wait for a message about successful installation.

Then you need to remove your device to which the container with keys refers and insert it back, after the device is found you can try.

If you have any questions because different versions CryptoPro may undergo various changes, so if you ask, leave your comments, I will always be happy to help you.