The 128-bit Internet Explorer Upgrade installs the
Rivest-Shamir-Adleman (RSA) certificate provider. With the RSA certificate
provider, you can import high grade digital certificates into Internet Explorer
in PFX format.
You can import only 512-bit key (low grade) digital
certificates into Internet Explorer.
Additional Information
WARNING: If you use Registry Editor incorrectly, you may cause serious
problems that may require you to reinstall your operating system. Microsoft
cannot guarantee that you can solve problems that result from using Registry
Editor incorrectly. Use Registry Editor at your own
risk.
Note that this behavior can also occur if a
previously exported 1024-bit key (high-grade) is improperly imported into a
different system.
When this occurs, the 128-bit Cryptographic
Service Provider (CSP) is not registered as the default provider. When you try
to import the 1024-bit certificate onto a 1024-bit system, it does not work
because it is trying to make a call to the default 512-bit base (exportable)
provider, which does not accept strong cryptographic key sizes (>512 bit).
To correct this problem, change the following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider
Types\Type 001
Name = "Microsoft Base Cryptographic Provider v1.0"
to
Name = "Microsoft Enhanced Cryptographic Provider v1.0"
This behavior can also occur if the user key for the
certificate you are trying to import already exists in the following registry
key:
HKEY_CURRENT_USER\Software\Microsoft\Cryptography\UserKeys
To work around this behavior, delete the appropriate user key in
the above registry key.