-3

Is it possible to embed a TLS certificate into an application or hide it somehow so that it’s not so easy for a user to just export it from cert manager on Windows? Or does all certificates have to be stored in the manager?

8
  • 4
    Why would exporting a certificate be a problem? Certificates are meant to be public info. Unless you are referring to the corresponding private key, are you?
    – Spyros
    Nov 22 at 7:41
  • 1
    Certificates and keys can be embedded into the application, stored as extra files, ... . Private keys can be stored externally on a smartcard, HSM ... . Details depend on the specific application, software library, framework etc. Nov 22 at 8:12
  • Yes, I mean the corresponding private key as well. I would like to make it a little more difficult for someone with admin rights to just export the certificate and run Wireshark to decrypt my HTTPS traffic from my app running on the same machine
    – Q-bertsuit
    Nov 22 at 8:32
  • @Q-bertsuit Give up. DRM doesn't work.
    – vidarlo
    Nov 22 at 8:42
  • @vidarlo Whats DRM?
    – Q-bertsuit
    Nov 22 at 8:49

1 Answer 1

0

A program can get its input from anywhere it has access to. This includes the internet, the standard input (e.g. keyboard), the filesystem, shared memory and its own code.

This means that yes, you can store in the program code certificates, private keys and anything else you may find it useful for the program to work the way you want.

But it's not secure.

Storing critical information (e.g. access keys) where a user has read access to and expecting that the user won't find it, has been tried many times in the past (a notable case being DRM) but has failed in every case.

Not the answer you're looking for? Browse other questions tagged or ask your own question.