msoft certification authority

We are using EAP-TLS for our wireless network. And were wondering, when a user makes a request for a certificate to authenticate they have the option to mark their private keys as exportable (We're using the mSOFT certification authority). This means they can move that certificate to another machine if they want. We want to stop this from being able to happen. When they make the request, I am the one that has to issue the certificate, but from what I can see in the MCA there is no way to see if they had that option checked. Does anyone know if it's possible and/or how to disable that ability? or do we have to switch to a different certification authority that supports it?
Who is Participating?
I've wondered how to do this before as well.  I've posted a question on a managed MSDN newsgroup and I'll shoot you any responses I get.

SeanChapmanAuthor Commented:
so far I've been told that I can modify the certificate template to disallow the requester from being able to mark the keys exportable. But I'm using a windows 2000 server right now and can't find how to do it. I might be switching to a 2003 server soon, so I'm hoping its easier then.
Sorry, this took a while.  This was the answer I recieved from MS:

"You need to reconfigure the certificate template so that the private key  
option "Allow private key to be exported" is not specified. When that
option is specified in the template, the subject can export the key; when
it is not specified, they cannot. See Certificate Templates Help for more
information. "

Hope that helps.
SeanChapmanAuthor Commented:
I figured that much out, but on our windows 2000 server I havent been able to find the option or anything to modify the certificate template. The only thing I've been able to do that works, it comment out some code in the asp page that processes the submit by form option. I just commented out the part where it checks for and creates the part of the request with the keys exportable, and that seemed to work.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.