Creating non-exportable certificates

Question

Level 1

0 points

Creating non-exportable certificates

I am looking for a way to prevent Certificate being exported out by users.
Certificate once imported into the keychain user shouldn't be allowed to export it out.

Mac Book Pro, Mac Mini, non exportable pki certificates

Posted on Nov 11, 2009 8:24 AM

Reply

Answer 1

K T

Level 7

23,877 points

Nov 11, 2009 8:33 AM in response to nirvana-osx

Hi nirvana-osx & welcome to discussions.

To stop a user from doing keychain exports, you would prohibit the user from having access to the keychain in the first place.

Reply

Answer 2

V.K.

Level 9

56,174 points

Nov 11, 2009 8:46 AM in response to nirvana-osx

nirvana-osx wrote:
I am looking for a way to prevent Certificate being exported out by users.
Certificate once imported into the keychain user shouldn't be allowed to export it out.

AFAIK, there is no way to do that.

Reply

Answer 3

nirvana-osx Author

Level 1

0 points

Nov 12, 2009 3:51 PM in response to K T

user should be able use them, but not be able to export it out. sort of tying down the certificate to a particular h/w.

Similar to non-exportable certificates in windows xp.

Reply

Answer 4

nirvana-osx Author

Level 1

0 points

Nov 12, 2009 3:56 PM in response to nirvana-osx

is it possible for an administrator to create a keychain and lock it down to be non-exportable

Reply

Answer 5

Jan 8, 2010 8:11 AM in response to nirvana-osx

In 10.5.8 and 10.6, you can import private keys and mark them as non-exportable with the security tool. From security(1):

-x Specify that private keys are non-extractable after
being imported.

This won't stop the user from copying the whole keychain off, however.

Reply