I want my application to verify that it is being run on a computer with a certificate issued by my Private CA. How can I do this when the computer is not on the network?

  • 2
    You use the CA certificate to verify it, potentially by embedding it in the application. It's probably going to be pretty easy to bypass that verification if you're trying to use it as some form of copy protection. – user Sep 18 '19 at 20:32

You query the certificate store where the private CA's cert would be stored. CA certs are stored in a collection of trusted certificates, often managed by the operating system but optionally separate from it (as Mozilla does) or even specific to a particular application. You'd need to know what store your private CA cert would be installed in, and check to see if it's there. The exact APIs will depend on the platform (OS and possibly runtime) that your app runs in, but an example (for .NET applications) would be https://docs.microsoft.com/en-us/dotnet/api/system.security.cryptography.x509certificates.x509store?view=netframework-4.8

To verify that the desired cert is present, you probably just want to include its thumbprint (cryptographic hash) in the app; that way, somebody can't extract the expected value out of the app. With that said, I'm not sure what you're actually trying to achieve here. If your goal is just to prevent the app from being run on unknown computers (basically, a simple form of DRM), I have bad news for you: any check you can put in, a knowledgeable hacker can remove by editing the app code using debugging or decompilation tools, and thus run the app with the check either being totally bypassed or having its result spoofed.

  • Unfortunately, that is the truth. Thanks for answering – Tee Aye Sep 19 '19 at 3:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.