In certificate based network authentication, is the user tied to just the system the certificate has been installed on such that if he tries to authenticate using another system access is denied?

2 Answers 2


When authentication uses a certificate, the important element is the private key: the mathematical object which corresponds to the public key (the one which is in the certificate). When a certificate is "installed on a system", this means that the private key is stored somewhere within that system. The authentication protocol implies usage of the private key: the key owner demonstrates that he has access to the private key, by doing some cryptography with it, which can be verified by using the public key in the certificate.

If the same (human) user tries to do the same thing from another computer where his private key is not, then he won't succeed and authentication will fail.

However, in some types of computer systems, and in particular the Microsoft / Active Directory world, the user's private key can be stored in the user's "profile", which means in some files which really are in the AD server and travel with him. The user opening a session on any computer in the network will find his certificate and private key as part of his profile, and thus will be able to use the private key for certificate-based authentication from any computer on the network.

Similarly, still with AD, authentication (as in "session was opened") on one machine can hop from machine to machine through the magic of Kerberos, even if certificates were somehow involved at some point.


The user is tied to holding the private key. That private key can be installed on as many different systems as the user desires. Ideally, the private key should also be password protected so that the system in use must have the key and the person using the system must have the password.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .