Is there a way to enforce a user password challenge for a certificate every single time in Windows Security Policy?

Question

In Local Security Policy configuration, I have set System cryptography: Force strong key protection for user keys stored on the computer to value User must enter a password each time they use a key.

After that, I have imported a SSL Client Certificate and created a password to protect it.

After that, I have proceeded to test using Chrome.

My observations are that the first time the SSL Client Certificate is engaged by the Chrome process, user is challenged to enter the password in order to use the certificate. After that, it does not matter if I open new tabs or even change the remote server's port in the address. The user won't be challenged again until Chrome is restarted.

Is there a way to enforce the password challenge every single time, even in the context of the same user process?

Answer 1

No, it is not possible. The behavior of the Chrome (and many other apps, like Outlook) is to acquire private key handle only once and then cache this handle for browser session duration (literally, while it is open in normal mode). As the result, you are not prompted for password again, because Chrome doesn't request the key again, it uses cached handle.

Update: Key handle is an abstraction which hides a real memory address, which in turn is not necessary an address in RAM, it can be a bus, device address, whatever else.

When you (app) request the private key, a key owner (CSP/KSP) creates a handle in memory and issue it to you. App itself cannot get physical access to key material given this handle. Instead, when app needs to perform cryptographic operation, the app requests CryptoAPI to perform certain operation (encryption, signing, hashing, etc.) and passes input data and key handle as input parameters. CryptoAPI communicates with CSP/KSP, perform requested operation behind the scenes and only return result to end app.

As the result, app doesn't have direct access to the key, nor cares where it is stored, as a file, in memory, on hardware device.