2

In the Windows certificate store, I am looking for a way (if it is possible) to store a public/private pair and keep the private exportable, BUT restrict the export to only those that know a password.

The only thing I've seen is that if I make the key exportable, EVERYONE who has access to my user account can export and place a password on the PFX file, but that is not what I want. I want that the export of the private key will be restricted to those that know a specific password.

Is it even possible?

3
  • 1
    What you want is not possible.
    – Ramhound
    Jun 3, 2013 at 14:08
  • 3
    The password that protects the certificates in the certificate store is the user's account password. What is the use case behind your question? Jun 3, 2013 at 14:24
  • @WernerHenze - that is all I wanted to know. Thanks! :-) You can write it as an answer and I'll mark it.
    – TCS
    Jun 3, 2013 at 14:56

2 Answers 2

0

The password that protects the certificate store and thus all certificates in the certificate store is the user's account password. If you can log into Windows, then you can access your own certificate store and of course also your own private keys. There is no extra password you can set on individual certificates in the certificate store.

1
  • Just what I wanted to know! Thanks :-)
    – TCS
    Jun 3, 2013 at 15:55
0

The Certificate Import Wizard (that gets called when you install the certificate with the private key) offers an option called “strong private key protection”.

Strong protection option for the import wizard

If it is selected, then after the import an additional Dialogue will allow you to adjust the CryptoAPI security level. When you set it to high, windows will query for an additional password, which is required for every use of the key.

CryptoAPI security level

That Password will be required during the export as well. Strong protection password gets queried during certificate export.

See also grawity's Answer to Question 298344, I took the liberty to snatch the screen-shots from there. Last screen-shot in German -- sorry, I have no English version available

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .