Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are considering using digital certs to verify that the machine connecting to our VPN service is in fact a company-owned machine. So one of my co-workers here mentioned that for a knowledgable user (and our users are for the most part CompSci PhD's) it would be trivial to copy the cert keys to another non-company-owned system that they want to use. My question is (and I've searched on Serverfault first :) is there some way to prevent the user from copying (exporting) the keypairs over to another machine? Or make the copied cert invalid if they do so? We in IT plan to be the ones installing the certs on the machines, but our users do need to have admin access to their machines to do their work. As well, the user's machines run a mix of Windows, Mac OS X and Linux OS's.

Thanks in advance for any answers provided...

share|improve this question
I believe the answer is going to be there is no way to prevent exporting if the user has admin access and the knowledge/skills to use it. – Zoredache Aug 14 '12 at 20:03
up vote 2 down vote accepted

In software, no, absolutely not. Even in windows, keys marked as non-exportable can be exported with a well-known GUI hack.

I'd suggest using smart cards for this purpose (wherein the key is stored and used on the card and generally not disclosed to the computer). That way, at least, the inside hacker would have to find the administrative password for the card or otherwise hack it, which is a lot less trivial than copying one stored in software.

You could also consider using computer certificates that encode the computer's hostname, and ensuring your authenticating software validates it. However, as it is generally quite easy to change computers' hostnames, I would suggest this would offer hardly any benefit.

share|improve this answer

No. Certificates (like everything else) are just bits. And bits can always be copied.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.