How to change the default CSP (usually 'Microsoft Enhanced Cryptographic Provider v1.0') to another default on enrollment page
Originally Published: 2009-03-03
Article Number
Applies To
RSA Registration Manager 6.7
Microsoft Internet Explorer
Issue
When a user attempts to enroll for a certificate using Microsoft Internet Explorer through RSA Certificate Manager (RCM) or RSA Registration Manager (RRM) enrollment page at https://<FQDN>:443/request-msie.xuda?domainID=xxxxxx, the list of crypto providers defaults to either "Microsoft Enhanced Cryptographic Provider v1.0" or "Microsoft Base Cryptographic Provider v1.0". How can the default be changed from Microsoft CSP to another Cryptographic Service Provider (say, "Microsoft Strong Cryptographic Provider")?
Resolution
1. Make a backup of <RCM-or-RRM-install-dir>\WebServer\enroll-server\icontrol.vbs
2. Using a text editor, update <RCM-or-RRM-install-dir>\WebServer\enroll-server\icontrol.vbs as instructed below
3. Search for the function definition "Sub FindProviders_certenroll(ProviderTypes, elementName)" and update the function as follows:
3.1. Search for the following line:
Dim csp1Index, csp2Index, cspCount
Add the following line immediately AFTER the above line to define a new variable "mycsp0Index":
Dim mycsp0Index
3.2. Search for the following line:
csp2Index = -1
Add the following line immediately AFTER the above line to initialize the new variable "mycsp0Index":
mycsp0Index = -1
3.3. Search for the following line:
If selection.text = "Microsoft Base Cryptographic Provider v1.0" Then
csp2Index = runningTotal
End If
Add the following lines immediately AFTER the above lines to set the new variable "mycsp0Index" if the preferred CSP found:
If provider = "Microsoft Strong Cryptographic Provider" Then
mycsp0Index = runningTotal
End If
3.4. Search for the following line:
If csp1Index > -1 Then
document.all(elementName).options.selectedIndex = csp1Index
End If
Add the following lines immediately AFTER the above lines to set the preferred CSP as default:
If mycsp0Index > -1 Then
document.all(elementName).options.selectedIndex = mycsp0Index
End If
4. Search for the function definition "Sub FindProviders_xenroll(ProviderTypes, elementName)" and update the function following the same steps as 3.1. through 3.4.
5. Save the above changes to icontrol.vbs
6. The enrollment page should now show "Microsoft Strong Cryptographic Provider" (or your preferred CSP), if available, as the default provider in the CSP list
Note that any future hot fixes or patches applied to your RSA Certificate Manager or RSA Registration Manager installation may overwrite the above changes. In that case, make the above edits again in an updated version of icontrol.vbs.
Related Articles
Generic REST Collector does not replace Query Parameters passed as part of the POST Request Body in RSA Identity Governanc… Number of Views How to change the registration code validity period for RSA Authenticator app registration? Number of Views SecurID Authenticator 5.1 for macOS Administrator's Guide Number of Views Data Purging process (as part of Data Archiving) fails with ORA-01722 in RSA Identity Governance & Lifecycle Number of Views Account collection failing with ORA-12899: value too large for column "AVUSER"."STX_ACC_122_266"."CAS17" in RSA Via Lifecy… Number of Views
Trending Articles
RSA Authentication Manager 8.9 Setup and Configuration Guide How to 'Trust' the RSA Authentication Manager Security Console Self-Signed Root CA certificate and prevent Cert warnings. RSA Authentication Manager 8.9 Release Notes (January 2026) Configure RSA Authentication Manager as a Secure Proxy Server for Cloud Access Service LDAP password authentication failed - Logon failure: unknown username or invalid password when attempting RADIUS authentic…
Don't see what you're looking for?
