I have developed a REST web application. The client only wants authorized computers to access the application. We have gone with 2-way TLS implementation where the client approves or rejects certificate requests.
Now the problem is that there are tools to extract the certificate from the machine even though the certificate was marked as non-exportable. We thought using the CertEnroll COM component to generate the CSR would have helped prevent exporting but marking the cert as non-exportable wasn't suffice.
The requirements are that only authorized computers can access the application and minimize the copy of permissions as much as possible.
Some options I have ruled out:
- Restricted IP Addresses, there are internal users we don't want to access the app.
- Browser fingerprinting, can't guarantee users coming from browser.