0

I'm trying to make certificate, which will have non-exportable private key once it is installed. Currently I'm creating cer and pvk files using makecert and then merging them to pfx file using pvk2pfx file. When creating private key, I'm not adding -pe option, hence I would expect my private key be non-exportable. Yet, when I'm importing pfx file, certificate import wizard features "Mark key as exportable". This makes it possible to export private key once it is imported (which I don't want).

I believe I might misunderstand some aspects of certificate creation, so, my question is - is it actually possible to generate certificate file, which will persistently restrict private key export after importing it?

Improve this question
3
  • @lentinant - Why does the third-party software need access to the private key? The private key typically is used by the server not the software that is distributed.
    – Ramhound
    Jan 16, 2020 at 12:58
  • @Ramhound I'm trying to make client certificate-like authorization. Software will access certain API, so I need some way to see if software has rights to do so. So far client certificate solution looked best for me.
    – lentinant
    Jan 16, 2020 at 13:25
  • @lentinant - Trying to issue certificates for each client cannot be scaled.
    – Ramhound
    Jan 16, 2020 at 13:52

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .