I have developed a REST web application. The client only wants authorized computers to access the application. We have gone with 2-way TLS implementation where the client approves or rejects certificate requests.

Now the problem is that there are tools to extract the certificate from the machine even though the certificate was marked as non-exportable. We thought using the CertEnroll COM component to generate the CSR would have helped prevent exporting but marking the cert as non-exportable wasn't suffice.

The requirements are that only authorized computers can access the application and minimize the copy of permissions as much as possible.

Some options I have ruled out:

  • Restricted IP Addresses, there are internal users we don't want to access the app.
  • Browser fingerprinting, can't guarantee users coming from browser.
  • 2
    Have you considered using a hardware token to store the keys? Smart cards are potentially the easiest but they are removable. Another option might be to store them in the TPM, which isn't removable.
    – Steve
    Nov 15, 2016 at 16:04

2 Answers 2


You trying to prevent a certificate from being copied from a computer that an attacker has full access to (as they would be able to run tools to extract non-exportable certificates) while at the same time having the certificate accessible for use by your application. This is simply not possible.

  • I understand that the Windows Key Store isn't bullet proof which is why the user can extract the certificate private key. I am asking what I can do in addition to 2-way TLS.
    – Dot Batch
    Nov 16, 2016 at 22:08

Within typical solutions HTTP/TLS/REST world no, it's not possible.

The only sound solution is to make unique hardware source of trust (key), and make sure you pick one that is supported by all browsers.

Half-assed solution is to build authentication on top of REST, and require it to have human-known secrets (passwords) to authenticate. Password leakage can be bound to humans, not computers. They are equally easy to distribute, yet a person, not operating system, will be accountable.

  • The current fear is password leakage from humans :/
    – Dot Batch
    Nov 16, 2016 at 22:09
  • then you need something better, unique and distributed by you (or registered by you) - certificates and/or hardware keys seem to be fit solution
    – Eugene
    Nov 20, 2016 at 23:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .