title: Generate a CrypoAPI (CAPI) Private Key
body: <p>I am trying to implement encryption at rest using an <a href="https://docs.microsoft.com/en-us/aspnet/core/security/data-protection/extensibility/key-management?view=aspnetcore-3.1#ixmlencryptor" rel="nofollow noreferrer">IXmlEncryptor</a>.  Specifically using a CertificateEncryptor.  (This is part of the IXmlRepository system for sharing keys for decrypting cookies and general <a href="https://docs.microsoft.com/en-us/aspnet/core/security/data-protection/implementation/key-management?view=aspnetcore-3.1" rel="nofollow noreferrer">key management</a> in ASP.NET Core.)</p>
  
  <p>This <a href="https://docs.microsoft.com/en-us/aspnet/core/security/data-protection/implementation/key-encryption-at-rest?view=aspnetcore-3.1#x509-certificate" rel="nofollow noreferrer">docs page</a> discusses using an X.509 certificate for this purpose.  </p>
  
  <p>It indicates that "only certificates with <strong>CAPI private keys</strong> are supported".</p>
  
  <p>Googling that shows that CAPI means Microsoft CryptAPI.  But I can not find much more about it, and what I can find seems to be C++ related.</p>
  
  <p>My "certificates guy" basically told me this when I asked him what a "CAPI private key" was: </p>
  
  <blockquote>
    <p>Microsoft generated PFX files converted to x509 have a password.  That would be the only thing I could think of.</p>
  </blockquote>
  
  <p>Is that the same thing?</p>
  
  <p>If not, <strong>how is a X.509 certificate with a CAPI private key created?</strong></p>
  
  <p>NOTE: The X.509 Certificate is the only option of those listed on the <a href="https://docs.microsoft.com/en-us/aspnet/core/security/data-protection/implementation/key-encryption-at-rest?view=aspnetcore-3.1#x509-certificate" rel="nofollow noreferrer">docs page</a> that will work on a Linux machine (container).  That is why I am not looking at any of the other (possibly easier) options.</p>