0

I am having a problem with my generated pkcs12 file using keytool.

I ran this command to generate a pkcs12 client-certificate:

keytool -importkeystore -srckeystore client.jks -srcstorepass password -srcalias clientkey -destkeystore client.p12 -deststoretype PKCS12 -deststorepass password -destalias clientkey -noprompt

The file client.p12 is created and browser loads it and will ask for the password then the website will load normally. The problem is in google-chrome or any other browser can change the file's password by using "Export" certificate in settings-advance-manage certificates section of the browser. Then they can load it to other pc's browser using the password they set when exporting it.

Is there a way to prevent this? Thanks in advance

  • Next time you're on the site, can you click the check box next to the answer so that this doesn't show up as unanswered? Thanks! – Andrew B Apr 15 '15 at 21:25
2

No, unless the workstations are heavily locked down (no administrator access) and the browser does not permit them to do that based on the security policy.

Even so, the secrecy of the private key is the last line of defense. If the password is known, anyone can decrypt the key so long as they can gain access to the file, and at that point there's nothing to stop them from doing whatever they want with it.

You can revoke the cert of any offending key+cert pairs that come up in an audit (say, one is found being used from more than one location), but honestly you're probably best off switching to using a solution that is more in line with how you want to manage it.

  • 1
    Good answer. I'd add: This is a social problem, not a technical one. If your users are not following your guidelines, the problem is that they are not following the guidelines - you need to figure out why and what to do about their lack of respect for procedures, rather than just force them to find another way around something a restriction they don't like. Because they will find another way, unless there is a reason that they understand (or sanctions that are bad enough that they will respect the rule anyway). – Jenny D Mar 6 '13 at 7:47
  • ok, got your point there. I was also thinking about administrator restrictions, I just asked first since it's my first time managing ssl certificates. Thanks! – weenux28 Mar 6 '13 at 15:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.