Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In certificate based network authentication, is the user tied to just the system the certificate has been installed on such that if he tries to authenticate using another system access is denied?

share|improve this question

When authentication uses a certificate, the important element is the private key: the mathematical object which corresponds to the public key (the one which is in the certificate). When a certificate is "installed on a system", this means that the private key is stored somewhere within that system. The authentication protocol implies usage of the private key: the key owner demonstrates that he has access to the private key, by doing some cryptography with it, which can be verified by using the public key in the certificate.

If the same (human) user tries to do the same thing from another computer where his private key is not, then he won't succeed and authentication will fail.

However, in some types of computer systems, and in particular the Microsoft / Active Directory world, the user's private key can be stored in the user's "profile", which means in some files which really are in the AD server and travel with him. The user opening a session on any computer in the network will find his certificate and private key as part of his profile, and thus will be able to use the private key for certificate-based authentication from any computer on the network.

Similarly, still with AD, authentication (as in "session was opened") on one machine can hop from machine to machine through the magic of Kerberos, even if certificates were somehow involved at some point.

share|improve this answer

The user is tied to holding the private key. That private key can be installed on as many different systems as the user desires. Ideally, the private key should also be password protected so that the system in use must have the key and the person using the system must have the password.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.