Limit use digital signature

Hi,

how can I limit the use of certificate digital signature installed in a PC with windows. I need to allow the use of certificate only for a certain web pages.

In other words,  Which kind of tools I need, to setup a limit for the users can only use the certificate to authenticate in a certain web pages

The main question is that some users have a digital signature for general purposes, and I want to limit that the users can only use the certificate digital signature that are installed into the windows certificate repository, to authenticate only in a web pages included in a list.

Regards
lnriveraAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

ahoffmannCommented:
when you import the cert into windows certificate store, you can select for which typrs this cert can be used, i.e. web site authentication, e-mail signature and such
but IIRC you cannot restrict a cert to be used on specific websites only as windows selects automatically which cert from the store to send, it will only ask if there're more than one cert matching
0
lnriveraAuthor Commented:
Maybe using a third party software solutions?

Another way, I'm not sure, if a HSM can do it (But the first problem is that HSM hardware solution is too expensive)

Regards
0
btanExec ConsultantCommented:
Actually if you are publishing the certificates to Active Directory, we can try to leverage on GPO to enforce some form of lockdown in autoenrollment and distribution of certificates. Also using the Enterprise CA not others.
http://technet.microsoft.com/en-us/library/cc754877.aspx

I was thinking of creating a customised cert template and specifying the security permission for it as well as "Do not automatically reenroll if a duplicate certificate exists in Active Directory" can be sort of some quick restriction to user even getting the certificates.
http://technet.microsoft.com/en-us/library/cc787781(v=ws.10).aspx

But not a full proof approach as certificates in the local user profile or on the user object in Active Directory are only managed if the certificate corresponds to a certificate template in Active Directory. Foreign certificates and certificates that do not contain the template extension are not managed. This is a transparent activity that is processed asynchronously.

Adding, there are add-on management tool like Microsoft's own Certificate Lifecycle Manager which may help - yet to explore further. Just some quick links

General - http://technet.microsoft.com/en-us/library/cc708653(v=ws.10).aspx
Security practice using it - http://technet.microsoft.com/en-us/library/cc720567(v=ws.10).aspx
0
ON-DEMAND: 10 Easy Ways to Lose a Password

Learn about the methods that hackers use to lift real, working credentials from even the most security-savvy employees in this on-demand webinar. We cover the importance of multi-factor authentication and how these solutions can better protect your business!

btanExec ConsultantCommented:
On a second thought, if we have control of web server, for example IIS, the webserver can enforce what type of client certificate to use for authentication and access...some configuration to be done for one to one

http://learn.iis.net/page.aspx/478/configuring-one-to-one-client-certificate-mappings/
0
lnriveraAuthor Commented:
Finally I filter the access looking for a fingerprint of the certificate in the IP Packets
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
lnriveraAuthor Commented:
Found workaround by myself
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Encryption

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.