1
I need to restrict usage of a certain site to a limited number of customers.
More than that, actually: I would like to allow access from a restricted number of physical devices (Win + Android).
This means I should generate "device locked" certificates.
What is the best way to generate and deploy such certificates?
Note that:
- Solution should not be browser specific (if possible; IE, FFox and Chrome are minimum).
- Browser should combine certificate with some hardware fingerprint before trying to use.
- I do not care if certificate is invalidated by system upgrade (I am perfectly OK issuing a new one... and deleting the old).
- Checking should be done "server-side".
UPDATE: I asked this on Security. I think this should be deleted.
ZioByte
Posted 2015-12-08T21:49:16.920
Reputation: 359
2There is no binding of a certificate to a hardware. If you want this you need to use certificates which are integrated into the hardware and cannot be extracted from there, i.e smartcards. All major browser should support these for client certificates but of course you need to a have some smartcard reader on the client and a way to create these smartcards. Apart from that: try security.stackexchange.com for better help. – Steffen Ullrich – 2015-12-08T21:59:24.300
thanks Steffen, Are You aware of a viable solution with cheap USB devices? – ZioByte – 2015-12-08T22:02:34.530
I have no idea what cheap is for you but there are USB tokens which are essentially a smartcard + reader inside a USB device. Look for eToken (Alladin,, now at Gemalto) or similar devices. I have no idea of the prices. – Steffen Ullrich – 2015-12-08T22:10:49.437
Overall, smartcards are probably the right way to go. But here's another option. I don't know about Android, but for Windows, there are ways to issue "machine certificates" whose private keys are stored in the system's cert store, and can be marked as non-exportable (but can be exported with the right tools and know-how if you're determined). Windows machine certs are sometimes used for WPA2 EAP-TLS authentication to an enterprise Wi-Fi network, so the machine can be remotely administered/backed up even when no user is logged in. – Spiff – 2015-12-09T00:47:10.140