Today I am given a pfx and told to access a website. I have absolutely no idea what was given to me initially, so please kindly confirm my understanding on a general level
1) the pfx is a container which is use to safeguard private key and certificate.
2) when I double click the pfx, it actually prompt me for a password. This is the password use for extracting the contents (e.g. private key and cert).
window prompted me to choose on which store to put the certificate or automatically select the certificate store
q1) how do I find out where is the certificate store on my system ?
q2) where is the private key extracted to then ?
In this scenario, I believe in order to access a website, the client will need to provide the certificate which contain the public key which the server will use to communicate with it.
In order for all these to work (client authentication)
- a) the client must generate a CSR with its public key inside
- b) the client must submit the CSR to be signed by an authorized CA
- c) the authorized CA certification and all roots certficates for it must be installed/available in the SERVER side
- d) the client send its certificate over to the server, the server validate the cert, uses the cert's public key to encrypt information before sending over to the client.
- e) the client who has the private key will decrypt this information etc etc.
this private key and certificate is store in a pfx file. Anyone with the pfx file (and the password to open the pfx) file, can communicate with the server.
q3) does that means anyone/client who has a valid certificate signed by a CA can access the server then ? how does the server choose which client to allow access and which not to ?