If say you want to set up a PKI and use EAP-TLS to authenticate all users and computers.

A computer's certificate is stored on that computer. But how can a user have a certificate? Where is it stored? What if a user logs in from another computer, how will he provide his certificate for client authentication?

  • Something that is very helpful for cryptographic proofs like this: an "entity" is defined as "something which knows something." It may be a computer which "knows" something by storing it on a disk, or it may be a human which "knows" something by storing it in their brain. Or it may be any other entity that meets that definition. – Cort Ammon Nov 14 '17 at 2:49

Personal Certificates are very common in a PKI infrastructure. And I would say that most often it's stored on the computer of that user/person.

It would of course be preferable to have the certificate and private keys stored on a smart card as mentioned in another answer but there is limited support for smart cards in for example smart phones.

  • One way to do this is to have unique keys and certificates (with the same DN) on several devices. Then you can easily revoke a certificate if a device is stolen. The problem with this approach is for example encryption. If there was an email encrypted with the public key corresponding to a certificate on your smart phone, that email cannot be read on your laptop and vice versa.
  • One middle ground would be to have different certificates on every device but with the same private key, with this approach you can still read encrypted messages on all units. But if one unit becomes compromised you will need to revoke all certificates.
  • And the simplest solution is to have the same certificate and keys distributed to all your units. This have the same drawbacks as the option above.

These certificates and keys are stored differently depending on OS and application. MacOS stores them in the key ring for most of the applications. Firefox can stored them in its own key ring, and so on.

  • So the certificate of every single domain user is stored on every single machine in the domain? Meaning each machine has to have a list of all the certificates of every single user? – Zouzou Ibba Jul 16 '17 at 21:12
  • No, you question indicates that you need a better understanding of PKI and certificates. This is usually done by having a Certificate Authority sign the public keys. In this way you only need to trust the CA at the server side to automatically trust all certificates signed by that CA. – Peter Jul 16 '17 at 21:21
  • Actually user certificates might be part of the roaming profile, but this is less common. It is more than case that the user has a personal device ('her laptop') which has her certificate locally (for EFS or mutual browser authentication). If you really need roaming users with certificates smart cards are important. – eckes Aug 17 '17 at 0:34

Apparently the user has a certificate stored in a smart card or digital signature token.

He can connect the token on the machine he logs on to, and the key is verified based on centralized key management server in the network.

  • So if a user exists on a domain he can't authenticate to that domain with EAP-TLS unless he has a USB or Smart Card? – Zouzou Ibba Jul 16 '17 at 15:21
  • Yes, the login process starts only after the card or token is inserted. – Kaushal Bhavsar Jul 16 '17 at 15:25
  • It can be stored on a smart card. It can also be stored on the device. Or on a floppy for all you care. A user certificate is a function of a certificate: authenticate users. How it's stored is irrelevant for it's function. – vidarlo Oct 15 '17 at 9:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.