3

When a certificate is being imported on Windows, at some point the following option is available:

[] mark this key as exportable

I understand that this is used in case the certificate needs to be transmitted from a client to a server, for example to establish a TLS communication channel. Is it correct to say that the key that needs to be exportable is the public key, so that the server can verify the client's identity during a handshake? Else, what exactly does this option do and when/why should it be/not be checked?

Improve this question
3
  • That's for the private key, it has nothing to do with the client establishing a connection to a remote server. If you have that checked then you can export the file and move it to another computer easier.
    – user
    Commented Jun 18, 2020 at 20:12
  • Talked about the communication channel because I am using WCF/C#. According to docs.microsoft.com/en-us/dotnet/framework/wcf/feature-details/…, In certain circumstances, the process identity must have access to the file that contains the private key associated with the X.509 certificate.. So it is apparently needed to sign an outgoing SOAP message...
    – evilmandarine
    Commented Jun 18, 2020 at 20:27
  • In dotnet core I was able to encrypt and decrypt with certificates that were not marked exportable by using the certificate store (new System.Security.Cryptography.X509Certificates.X509Store()). I'm not sure if WCF has additional limitations.
    – user
    Commented Jun 19, 2020 at 13:19

2 Answers 2

Reset to default
2

Marking the private key as exportable gives someone with the permission to the private key the ability to export it into a PFX file. The ability to read the key and the ability to export the key are two separate things.

Using the private key for signing or decryption is not in any way related to exportability. Windows exposes APIs that you can call to use the private key for various operations which are gated by whether the calling user has permissions to use the key. This is independent of export.

In the link you left in the comment, what it's hinting at is the permission to access the private key. This is controlled primarily through file ACLs (or other implementations based on key providers). You can view them by opening MMC > Add Certificate snap-in > select computer > select Personal > right click some certificate > Manage Private Keys.

ACL Editor

In order to export the key you need permission to access the private key and the key must also be marked as exportable.

Improve this answer
2
  • Ok, I understand. But then this must be related to the way WCF works. Read a lot of documentation/SO questions about this and everywhere, including MS doc, the client certificate needs to be created with an exportable private key. So it really looks like WCF needs to export the key, not only to read it. I'll accept this answer because the initial question was not related to WCF in particular. Thank you for the explanantion. ps. I do not have the "Manage private keys" option (running Win10).
    – evilmandarine
    Commented Jun 18, 2020 at 21:54
  • 1
    WCF absolutely does NOT need the key exportable. You may find it helps with management of things, but the operation of WCF itself doesn't require the key to be exportable.
    – Steve
    Commented Jun 18, 2020 at 23:16
0

Although, the question is answered, it doesn't really answer the question: when this exportable key option should be enabled/checked. Some time ago I wrote a blog post that talks about this topic: The case about exportable keys.

In short, only user encryption certificates should be allowed for export with private key for backup purposes. In all other cases, private key should not be exportable.

Improve this answer
1
  • I actually read your blog post during research. What I still do not get is the existence of that option during import in Windows, as I thought the 'exportable' flag must be set already when the certificate is created.
    – evilmandarine
    Commented Jun 19, 2020 at 11:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .