0

Is it acceptable to store a client cert's private key as exportable in the computer's certificate store?

I have a .NET desktop app that installs client certificates in local machine\personal. The certificates are generated by a protected API. The certs are used to authenticate service calls by another .NET desktop application.

If the private keys are not marked as exportable, then the second desktop application is not able to access them unless the account that it is run under is given access permissions, or the application is run as an administrator. If access permissions were to be granted, this would need to be done programmatically and probably without additional user interactions. This would be complicated by the fact that the cert installer application runs with elevated privileges which mean it is ignorant of the user's account - so it doesn't know what account would need to be assigned the permissions.

If the private keys are marked as exportable then they could be protected with a password. Then the application that makes use of the certs would need to use the password to access them. However this would be a paradoxical solution because the client application has no way to authenticate itself to access the private key - until it can access the private key.

If it is not acceptable to store certificate with an exportable private key, then how could you avoid it in the scenario I've described? If it is, then how would you detect or protect against the certificate theft?

Improve this question
8
  • Windows certificate store can store the private key as non-exportable and without password. You will need to change some registries. If you can do that, you will be able to access private key via crypto API windows.
    – sau_t
    Commented Mar 23, 2022 at 12:20
  • Thanks. I'm able to add it so that it is not exportable, but doing so results in the application that uses it needing to run under administrative privileges to access it. I was thinking about making it non-exportable and trying to programmatically grant access to it to authenticated users. Would there be value in this?
    – Peter Dongan
    Commented Mar 23, 2022 at 12:29
  • Create a non-admin user for your application. Import private key into the user cert store (Personal) not the system store. Then your application running from that user will be able to access the certificate and private key.
    – sau_t
    Commented Mar 23, 2022 at 12:37
  • Thanks. Iirc I used the machine store because I needed to run the cert installer app as an admin and therefore it was ignorant of what user to install the cert for. Don't remember what specifically required the elevated privileges. Probably installing a root cert to the trusted store. I might revisit it.
    – Peter Dongan
    Commented Mar 23, 2022 at 12:43
  • This link will be helpful stackoverflow.com/questions/5171117/…
    – sau_t
    Commented Mar 23, 2022 at 12:43

1 Answer 1

Reset to default
1

As per the discussion in the comments:

Create a non-admin user for your application. Import private key into the user cert store (Personal) not the system store. Then your application running from that user will be able to access the certificate and private key.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .