If your product will use one of your web services to make calls on an Xbox Live service, either directly or on behalf of individual users, you’ll need a business partner certificate for that sort of call.
For information about how to use business partner certificates to make calls to Xbox Live services, see “Calling Xbox Live from a Partner Web Service” in the XDK Documentation on the Xbox Game Developer site.
For information about how to make calls from your title service, see Calling Xbox Live Services from your Title Service.
For information about security tokens, see the Understanding Security Tokens.
Business partner certificates are X.509 certificates that are issued by an Xbox Live Certificate Authority.
Business partner certificates contain private keys that the server needs access to. Because of this and the access that they have to interact with the Live services on behalf of users and the publisher, these should not be shared between publisher and studios wherever possible. If a studio is working with a publisher and needs a business partner certificate for a title, it is recommended that you work with your Developer Account Manager and possibly create a separate but jointly managed XDP Publisher that the studio and publisher both have access to on the shared projects that need the business partner certificates.
It is a general recommendation that you create a new web service in XDP to create the business partner certificates under rather than add them onto existing Web Services. You can simply create a new one called “BP Certs” and add them to that, with no additional setup of that Web Service needed. This helps if you need to revoke access of a set of business partner certificates by targeting the Web Service they were created under in XDP.
If you have a scenario wherein two partners both need business partner certificates out of a shared XDP Publisher, create a web service for each and ensure that business partner certificates for each partner are created under their own defined Web Service for ease.
In order to maintain the security of the private key to be associated with that certificate, the certificate’s generation includes the following steps:
# Generate a properly sized key and make a certificate request
$certRequest = new-object -ComObject X509Enrollment.CX509CertificateRequestCertificate
$certRequest.Initialize(2) # Initialize in the machine context
$certRequest.PrivateKey.Length = 2048
$certRequest.PrivateKey.ProviderName = "Microsoft Enhanced RSA and AES Cryptographic Provider"
# Set XCN_NCRYPT_ALLOW_EXPORT_FLAG
$certRequest.PrivateKey.ExportPolicy = 2
# Subject is requred by the tool even though it is overwritten when we generate the certificate
$subject = new-object -ComObject X509Enrollment.CX500DistinguishedName
$subject.Encode("CN=NOT USED")
$certRequest.Subject = $subject
# Stores private key to allow auto binding. Import the .cer file you get back into the Local Machine/Personal store to bind to the private key
$enroll = new-object -ComObject X509Enrollment.CX509Enrollment
$enroll.InitializeFromRequest($certRequest)
$strCert = $enroll.CreateRequest(0)
# Then export public key to be e-mailed
$certRequest.PrivateKey.Export("PUBLICBLOB", 0x40000001)
The preceding script’s output is the public key (also known as CSP blob).
mmc.exe