Is there any mechanism in SSL/TLS which allows a certificate to be bound to a device? Example:
There is a client who talks to a server, and during SSL/TLS setup, there is mutual authentication. The server verifies that the client presented a certificate which is valid (Expiration date, CRL/OCSP, etc.) and has whatever required fields the server wants to see (x.example.com domain, signer of XYZ Corp, etc.).
However we would also like the server to relate certain characteristics of the client certificate (thumbprint, serial, etc.) to the client itself (IP, Hostname, NetBT, etc.). Is there any built-in or third-party mechanism that does this, or am I missing something?
The concern is that a certificate will be exported from a client by someone with elevated privileges (We will have strict ACLs but we are assuming these are ineffective at stopping the attacker), and then installed on a second device. I understand that, if someone had elevated privileges on a machine they could just do whatever badness they wanted to do on that box using the existing environment, but if they are able to use the certificate on a second device, they could bypass security controls (local firewalls, av, etc.) and security audits (firewall is enabled, av is on, actions are logged and sent to syslog server, etc.).