Using a machine certificate for SSL client authentication
Assuming a web site enforces SSL client authentication and the client machine (running Windows) is equipped with a certificate which the server accepts for that purpose. The certificate resides in the machine certificate store.
Under what conditions can a user fire up a browser (IE or anything else which relies on the Windows cert store, and runs as a user process) and authenticate to the web site with the machine certificate? Can any user access the certificate, or do they need to be admins, or maybe hold a particular permission (and which)?
windows ssl client-certificate
asked Jan 23 at 12:48
user149408user149408
5931418
add a comment |
Assuming a web site enforces SSL client authentication and the client machine (running Windows) is equipped with a certificate which the server accepts for that purpose. The certificate resides in the machine certificate store.
Under what conditions can a user fire up a browser (IE or anything else which relies on the Windows cert store, and runs as a user process) and authenticate to the web site with the machine certificate? Can any user access the certificate, or do they need to be admins, or maybe hold a particular permission (and which)?
windows ssl client-certificate
asked Jan 23 at 12:48
user149408user149408
5931418
Are you asking with regards to trust, in that the browser will trust the certificate in the store, or in some other context?
– Ramhound
Jan 23 at 13:15
@Ramhound I am asking with regards to user permissions. Who has permission to authenticate with a certificate in the machine store (not the user store)? All users? Just admins? Users with a particular permission?
– user149408
Jan 23 at 16:46
add a comment |
Assuming a web site enforces SSL client authentication and the client machine (running Windows) is equipped with a certificate which the server accepts for that purpose. The certificate resides in the machine certificate store.
Under what conditions can a user fire up a browser (IE or anything else which relies on the Windows cert store, and runs as a user process) and authenticate to the web site with the machine certificate? Can any user access the certificate, or do they need to be admins, or maybe hold a particular permission (and which)?
windows ssl client-certificate
asked Jan 23 at 12:48
user149408user149408
5931418
Assuming a web site enforces SSL client authentication and the client machine (running Windows) is equipped with a certificate which the server accepts for that purpose. The certificate resides in the machine certificate store.
Under what conditions can a user fire up a browser (IE or anything else which relies on the Windows cert store, and runs as a user process) and authenticate to the web site with the machine certificate? Can any user access the certificate, or do they need to be admins, or maybe hold a particular permission (and which)?
windows ssl client-certificate
windows ssl client-certificate
asked Jan 23 at 12:48
user149408user149408
5931418
asked Jan 23 at 12:48
user149408user149408
5931418
edited Jan 23 at 16:47
user149408
asked Jan 23 at 12:48
user149408user149408
5931418
asked Jan 23 at 12:48
user149408user149408
5931418
asked Jan 23 at 12:48
user149408user149408
5931418
5931418
Are you asking with regards to trust, in that the browser will trust the certificate in the store, or in some other context?
– Ramhound
Jan 23 at 13:15
@Ramhound I am asking with regards to user permissions. Who has permission to authenticate with a certificate in the machine store (not the user store)? All users? Just admins? Users with a particular permission?
– user149408
Jan 23 at 16:46
add a comment |
Are you asking with regards to trust, in that the browser will trust the certificate in the store, or in some other context?
– Ramhound
Jan 23 at 13:15
@Ramhound I am asking with regards to user permissions. Who has permission to authenticate with a certificate in the machine store (not the user store)? All users? Just admins? Users with a particular permission?
– user149408
Jan 23 at 16:46
Are you asking with regards to trust, in that the browser will trust the certificate in the store, or in some other context?
– Ramhound
Jan 23 at 13:15
Are you asking with regards to trust, in that the browser will trust the certificate in the store, or in some other context?
– Ramhound
Jan 23 at 13:15
@Ramhound I am asking with regards to user permissions. Who has permission to authenticate with a certificate in the machine store (not the user store)? All users? Just admins? Users with a particular permission?
– user149408
Jan 23 at 16:46
@Ramhound I am asking with regards to user permissions. Who has permission to authenticate with a certificate in the machine store (not the user store)? All users? Just admins? Users with a particular permission?
– user149408
Jan 23 at 16:46
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1397446%2fusing-a-machine-certificate-for-ssl-client-authentication%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1397446%2fusing-a-machine-certificate-for-ssl-client-authentication%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Are you asking with regards to trust, in that the browser will trust the certificate in the store, or in some other context?
– Ramhound
Jan 23 at 13:15
@Ramhound I am asking with regards to user permissions. Who has permission to authenticate with a certificate in the machine store (not the user store)? All users? Just admins? Users with a particular permission?
– user149408
Jan 23 at 16:46