Home/ Questions/Q 8159869
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-06T18:03:56+00:00

I’m asking this question because I have gone through the tutorial posted here: Preventing

  • 0

I’m asking this question because I have gone through the tutorial posted here:

Preventing Duplication of the x509 Certificate Used on a WCF Client?

And I am not understanding why the client couldn’t just go to another computer and install the Root CA and install the Public CA to connect from a different computer?

I want to be able to install a certificate on a client’s computer that only authorizes that computer to connect to the WCF service. If they “buy” another certificate, I would create it off the Root CA and install it on the other computer they want which would now authorize that computer (2 computers can now connect to this service ONLY).

How does the posted method prevent a different computer from being authenticated if the client just copies the Root CA and Public CA and installs it onto a different computer?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    You can install end-user certificate to Windows certificate storage and when installing the certificate, specify that the private key should be non-exportable. Such key can not be exported and thus copied (at least in theory). Next, you can give the user a hardware with the key — a USB cryptotoken or smartcard. Such hardware also doesn’t let private keys to be exported from the device, yet you need to be aware of this attack.

    • 0