0

I am attempting to establish an internal CA within my company. One of the primary purposes of doing this is to issue certificates to our customers, which they will use to establish TLS connections between our client and server applications (both Windows OS-based). I am currently working under the following constraints:

  • A server certificate will be issued to each of our server customers, and should be installed on the customer's server such that our Server Application can use it to establish TLS sessions.
  • A trusted root certificate for our CA will be packaged with our Client Application, and should be installed silently along with the application in such a way that the Client Application can use it to verify the server certificate. (The installer is assumed to have administrative access on the client machine.)
  • The trusted root certificate should be available to any user of the Client Application on the client machine, and should not require a password from the user to access.
  • I hesitate to place the trusted root certificate in the "Trusted Root Certification Authorities" section of the Local Machine certificate store, because it could then be used in a larger scope than simply authenticating our application (to authenticate web pages for IE, for example.) In the event that our root certificate is compromised, I would rather limit the damage to our own application.

Where and how should I be installing the server certificate and the trusted root certificate on the server and client machines (again, both using a Windows OS) such that these constraints are met?

Will Shipley
  • 217
  • 1
  • 3
  • 8

1 Answers1

0

The Common Application Data folder is an appropriate location for both the CA certificate and the server certificate (not the server private key, though!)

The 'how' of installation depends on the packaging and distribution method--for WiX, you'd use something like:

<Directory Id="CommonAppDataFolder" Name="ComApptDt" >
    <Directory Id="ProductAppData" Name="ProductName" >
    <!-- add reference to the appropriate certificate here -->
    </Directory>
</Directory>

Determining the location of the Common AppData folder in code depends on the programming language and framework. .NET has a the Environment.SpecialFolders enumeration. For native C++, How do I get the application data path in Windows using C++? is a good place to start.

Community
  • 1
  • 1
cqcallaw
  • 1,463
  • 3
  • 18
  • 29