0

I dont know how to search for something like this, but here is what I like to do:

I have an internet accessible LAMP application that uses HTTPS: The user must login to access it.

I would like to make it so that each authenticated user can only access it from authorized workstations.

Is there a way to create a certificate that only is valid from the workstation or mobile device it was created on?

Maybe it can be based on a hardware serial # or something else specific to that machine.

Any docs that explain how to do this?

12
  • The answer that jumps out to me is to just use AES/private key, but I think I may be overlooking what you want in favor of the obvious. Are you trying to ensure that the key absolutely cannot be exported?
    – Marcus_33
    Dec 12, 2011 at 19:09
  • I need to prevent a user from exporting the certificate and using it on another machine. I want to know that they can't login from a public machine for example, but can login only from a laptop that was given to them.
    – user603749
    Dec 12, 2011 at 19:32
  • Maby I'm mistaken but isn't server sending certificate to client not the other way? Server only knows for sure the IP address of client. Maby you should set restriction for IP or maby restrictions for MAC address on router if it is local network (unfotunetly mac can be easily changed)?
    – piotrekkr
    Dec 12, 2011 at 19:32
  • The big issues here is that a user on a public computer could be open to attack by keystroke capturing trojans. Also the user could forget to logout and leave the app open to the next person. Yes, a Mac address can be changed easily. The only other way I can think of is using the computers hardware (E.g a serial number)
    – user603749
    Dec 12, 2011 at 19:42
  • @piotrekkr no, what the OP is asking about is called client-side authentication, and it's widely used in SSL/TLS Dec 13, 2011 at 6:37

1 Answer 1

1

Certificates authenticate users (in wide meaning), not particular hardware.

For any application that needs to be bound to specific hardware you should search for other ways, which would involve custom code written for each platform and maybe even hardware (long time ago LPT dongles were used, then they were replaced by USB dongles).

But it's easier to review your application and business design.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.