In Local Security Policy configuration, I have set System cryptography: Force strong key protection for user keys stored on the computer to value User must enter a password each time they use a key.

After that, I have imported a SSL Client Certificate and created a password to protect it.

After that, I have proceeded to test using Chrome.

My observations are that the first time the SSL Client Certificate is engaged by the Chrome process, user is challenged to enter the password in order to use the certificate. After that, it does not matter if I open new tabs or even change the remote server's port in the address. The user won't be challenged again until Chrome is restarted.

Is there a way to enforce the password challenge every single time, even in the context of the same user process?

1 Answer 1


No, it is not possible. The behavior of the Chrome (and many other apps, like Outlook) is to acquire private key handle only once and then cache this handle for browser session duration (literally, while it is open in normal mode). As the result, you are not prompted for password again, because Chrome doesn't request the key again, it uses cached handle.

Update: Key handle is an abstraction which hides a real memory address, which in turn is not necessary an address in RAM, it can be a bus, device address, whatever else.

When you (app) request the private key, a key owner (CSP/KSP) creates a handle in memory and issue it to you. App itself cannot get physical access to key material given this handle. Instead, when app needs to perform cryptographic operation, the app requests CryptoAPI to perform certain operation (encryption, signing, hashing, etc.) and passes input data and key handle as input parameters. CryptoAPI communicates with CSP/KSP, perform requested operation behind the scenes and only return result to end app.

As the result, app doesn't have direct access to the key, nor cares where it is stored, as a file, in memory, on hardware device.

  • Thanks for the answer! I'd appreciate if you could explain what a "private key handle" is. As I understand Chrome does not have direct access to the private key (because is private) and with every new TLS handshake it needs to request the system to sign data with it. Would the same apply if the client ssl certificate was physically stored in an attached hardware device like a smart card? Nov 9, 2022 at 12:56
  • I've updated my response by quickly describing how this works in Windows.
    – Crypt32
    Nov 9, 2022 at 13:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.