2

We have an ASP.NET web app running in IIS, with about 200 users, some are inside our LAN and other ones are outside our LAN. Every user has a userid account and a password to login.

Besides those credentials, we want to add more security for accessing that web app with this requirement:

A user will access that web app only from its PC. If user goes to other place and uses other PC, then he/she will not be able to access that web app.

Our question is:

IF:

  • A client-side certificate stored in the user's PC
  • IIS is configured to accept client side certificates

THEN:

The user can access the web app only from that PC. If the user uses a different PC in which there is no client-side certificate, then user will not access web app.

Is that correct?

|improve this question
2

You can see the client-side certificate as a key. Wherever the key is installed, the client will be able to connect. At the opposite, wherever the key is not installed, the client will not be able to connect.

However, bear in mind that the client-side certificate is actually just a file a browser can import. It is not something hard-linked to a physical computer in any way. Therefore unless there are supplementary measures taken nothing prevents someone from importing their client certificate in several browsers running on different computers.

|improve this answer
  • Thanks. What other supplementary measures should be taken for preventing importing a client certificate to different PC? Just asking for some ideas or a link to read more about it. – Delmonte May 13 '15 at 14:05
  • If the budget is there, I guess storing the Key secured with a TPM provides the properties you want. – SEJPM May 13 '15 at 18:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.