System Center Mobile Device Manager TechCenter >
Mobility Forums
>
System Center Mobile Device Manager
>
importing personal certificate
importing personal certificate
- Hello,
can I import a personal certificate to a Windows Mobile device in a way that the private key will be marked as "non exportable"? Otherwise, if the device gets lost, any unauthorized person can export the private key then.
there are flags CRYPT_EXPORTABLE and CRYPT_USER_PROTECTED http://msdn.microsoft.com/en-us/library/aa924245.aspx
If someone knows if these flags in PFXImportCertStore are set or not that would help me a lot
Unfortunately the Windows Mobile UI does not offer to set these flags during the certificate import process
Martin
All Replies
- Only one thread at a time please :)
Continue discussion in the other thread: http://social.technet.microsoft.com/Forums/en-US/exchangesvrmobility/thread/282d42ef-467b-4de8-8644-0e82c5df9354 - I think the discussion has come to its logical conclusion :
1. The private certificate is "Non exportable" when enrolled from the device.
2. You need to write your own interface to import a PFX certificate and mark it as "Non exportable"
3. Set a crazy complicated password (That looks like an encryption key) on the certificates.
Additional security measures should also be enable. set a power on password and enable encryption.
Cheers Wayne
Airloom- Proposed As Answer byWayne Phillips.MVP, ModeratorMonday, November 09, 2009 12:14 AM
