Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

msoft certification authority

Posted on 2004-08-16
5
Medium Priority
?
252 Views
Last Modified: 2010-04-11
We are using EAP-TLS for our wireless network. And were wondering, when a user makes a request for a certificate to authenticate they have the option to mark their private keys as exportable (We're using the mSOFT certification authority). This means they can move that certificate to another machine if they want. We want to stop this from being able to happen. When they make the request, I am the one that has to issue the certificate, but from what I can see in the MCA there is no way to see if they had that option checked. Does anyone know if it's possible and/or how to disable that ability? or do we have to switch to a different certification authority that supports it?
0
Comment
Question by:SeanChapman
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
5 Comments
 
LVL 1

Expert Comment

by:mgrass
ID: 11823677
I've wondered how to do this before as well.  I've posted a question on a managed MSDN newsgroup and I'll shoot you any responses I get.

Mike
0
 
LVL 1

Author Comment

by:SeanChapman
ID: 11823751
so far I've been told that I can modify the certificate template to disallow the requester from being able to mark the keys exportable. But I'm using a windows 2000 server right now and can't find how to do it. I might be switching to a 2003 server soon, so I'm hoping its easier then.
0
 
LVL 1

Expert Comment

by:mgrass
ID: 11908078
Sorry, this took a while.  This was the answer I recieved from MS:

"You need to reconfigure the certificate template so that the private key  
option "Allow private key to be exported" is not specified. When that
option is specified in the template, the subject can export the key; when
it is not specified, they cannot. See Certificate Templates Help for more
information. "

Hope that helps.
0
 
LVL 1

Author Comment

by:SeanChapman
ID: 11914034
I figured that much out, but on our windows 2000 server I havent been able to find the option or anything to modify the certificate template. The only thing I've been able to do that works, it comment out some code in the asp page that processes the submit by form option. I just commented out the part where it checks for and creates the part of the request with the keys exportable, and that seemed to work.
0
 
LVL 1

Accepted Solution

by:
mpvbrao earned 2000 total points
ID: 11943278
0

Featured Post

Automating Your MSP Business

The road to profitability.
Delivering superior services is key to ensuring customer satisfaction and the consequent long-term relationships that enable MSPs to lock in predictable, recurring revenue. What's the best way to deliver superior service? One word: automation.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

What's worse than having your data encrypted by ransomware? Getting attacked by a so-called "wiper," which simply destroys the data and offers you no hope of ever seeing it again.
I don't pretend to be an expert at this, but I have found a few things that are useful. I hope that sharing them here will help others, so they will not have to face some rather hard choices. Since I felt this to be a topic of enough importance and…
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …
We’ve all felt that sense of false security before—locking down external access to a database or component and feeling like we’ve done all we need to do to secure company data. But that feeling is fleeting. Attacks these days can happen in many w…

636 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question