Exportable private key

1

Hi,

I am currently testing Hub with 2 agents. It works pretty nice but we have 1 issue here. We would like to store all certificates at hub machine’s store and use certificate subscription to use them on other machinces. Certificates requested this way (and not only this way) are always imported with exportable private key. Is there any way to make them non exportable during import to target machine??

2

Hi,

Currently no, we do not import certs as non-exportable. You could set deployment to no store then run your own script to import the pfx, but there is a still a PFX on disk so that may defeat the purpose.

However it’s possible we could implement that in general.

Can you describe more about why you are looking for that specific capability?

3

This feature would be great. If it’s available at deployment/task level would be even better!
I thought about solving it via custom script in 2 ways:

  1. Export pfx to disk, import it as non exportable, and delete pfx
  2. Export pfx protected by password to disk, keep CliXml encrypted password file on every target machine (it would be a headache) but pfx file would be relatively safe

To be honest I haven’t teseted it out, specially in scenario where I import pfx manually via custom script and then use subscription request for IIS. I have a feeling certificate would be doubled in machine store.

It’s strictly security reasons. We realize there are many tools which can export nonexportable private keys but we need it to be as hard as possible. Therefore it would be nice to have this funcionality builtin.

4

Ok, we’ll add that to our list of features to plan.

It wouldn’t make sense to have the pfx stored as non-exportable but still have the original pfx on disk, so there’s some work around how to achieve deployment tasks etc. They work from the pfx under ProgramData\certify\assets but we could probably clean that up after all task have successfully completed.

5

As long as you use password protected pfx it can stay under ProgramData\certify\assets. But now another question comes to mind: how safe is default sqllite configuration? Is db file encrypted? Is password in connection string encrypted?

6

No the SQLite database is not encrypted. Stored Credentials within the db are encrypted using Windows DAPI.

7

However, it’s possible to migrate to a data store in SQL Server or Postgres and use whatever native encryption those have.