checkId: check.crypto.cryptopro plugin: stellaops.doctor.cryptography severity: info tags: [crypto, cryptopro, gost, windows, regional]

CryptoPro CSP

Runbook — for Stella Ops platform administrators running the CryptoPro CSP (Windows GOST provider) on a Russian / GOST deployment.

check.crypto.cryptopro validates that CryptoPro CSP is installed and configured on a Windows host. It runs when Cryptography:CryptoPro:Enabled=true, or on Windows when Cryptography:Gost:Enabled=true and Cryptography:Gost:Provider=cryptopro. On non-Windows hosts it returns a honest Skip (use the OpenSSL GOST engine on Linux — see check.crypto.gost).

What it checks

Build flag. The STELLAOPS_CRYPTO_PRO environment variable must be 1 / true; otherwise CryptoPro support may not be compiled into the image.
Installation. One of C:\Program Files\Crypto Pro\CSP or C:\Program Files (x86)\Crypto Pro\CSP must exist, and the csptest.exe / cryptcp.exe tooling and version.txt are surfaced as evidence.
License. Cryptography:CryptoPro:LicensePath, when configured, must point at an existing file.
Container. Cryptography:CryptoPro:ContainerName, when configured, is reported for triage.

Symptoms

STELLAOPS_CRYPTO_PRO build flag not set - CryptoPro support may not be compiled in
CryptoPro CSP installation not found
CryptoPro license file not found: <path>
CryptoPro CSP is only available on Windows (Skip on Linux/macOS).

Remediation

Install CryptoPro CSP. Download and install CryptoPro CSP from the vendor (cryptopro.ru) on the Windows host that runs the GOST-enabled service.
Set the build flag. Set STELLAOPS_CRYPTO_PRO=1 in the service environment (compose .env) so the CryptoPro provider is compiled in and loaded.
Configure the license. Set Cryptography:CryptoPro:LicensePath (and Cryptography:CryptoPro:ContainerName where applicable) to the host-mounted license file.

Verify with:

stella doctor --check check.crypto.cryptopro

Notes

This is a regional crypto provider that runs via plugin; it is never a cloud-managed default. On Linux deployments use the OpenSSL GOST engine instead (check.crypto.gost).
The probe inspects local installation paths and configuration only — it performs no network call.