I have a ssl certificate in a pfx. I am using this to secure an https application. Can this same pfx be used to sign an exe?

The reason I am asking is that this pfx gets shipped with the application and the domain points to localhost. I just want to know if there is harm in shipping this pfx such as signing an exe.

  • 1
    Can you explain why you need to ship the PFX file and what is the significance of exe signing in your use case? – Mike Goodwin Oct 7 '16 at 14:57
  • There is a website that needs to connect to localhost. the Website is ssl therefore the localhost connection needs to be too. The website hosts a exe which the client downloads and runs and hosts but it needs to be ssl. – maxfridbe Oct 7 '16 at 17:50

If the PFX file contains your private key and is then shipped with your application, then all machines that have your application have your private key. Unless you are confident about the security of these machines, then you have compromised your private key.

In general, you should not require the servers private key/PFX file to be sent to clients. Although you may need to send private keys to clients if your server is authenticating the clients using the certificates (mutual SSL). In this case you would need a unique private key/PFX per client.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.