Is it possible to embed a TLS certificate into an application or hide it somehow so that it’s not so easy for a user to just export it from cert manager on Windows? Or does all certificates have to be stored in the manager?
-
4Why would exporting a certificate be a problem? Certificates are meant to be public info. Unless you are referring to the corresponding private key, are you?– SpyrosNov 22, 2022 at 7:41
-
1Certificates and keys can be embedded into the application, stored as extra files, ... . Private keys can be stored externally on a smartcard, HSM ... . Details depend on the specific application, software library, framework etc.– Steffen UllrichNov 22, 2022 at 8:12
-
Yes, I mean the corresponding private key as well. I would like to make it a little more difficult for someone with admin rights to just export the certificate and run Wireshark to decrypt my HTTPS traffic from my app running on the same machine– Q-bertsuitNov 22, 2022 at 8:32
-
@Q-bertsuit Give up. DRM doesn't work.– vidarloNov 22, 2022 at 8:42
-
@vidarlo Whats DRM?– Q-bertsuitNov 22, 2022 at 8:49
|
Show 3 more comments
1 Answer
A program can get its input from anywhere it has access to. This includes the internet, the standard input (e.g. keyboard), the filesystem, shared memory and its own code.
This means that yes, you can store in the program code certificates, private keys and anything else you may find it useful for the program to work the way you want.
But it's not secure.
Storing critical information (e.g. access keys) where a user has read access to and expecting that the user won't find it, has been tried many times in the past (a notable case being DRM) but has failed in every case.