ā07-25-2024
07:26 PM
- last edited on
ā07-26-2024
01:41 AM
by
shazubai
Dear Community,
Current we plan testing EAP-FAST (Eap-MSCHAPv2, Eap-TLS) authentication.
By Machined join domain and get certificate to be trusted device. What if the another new machine imported certificate (export cert from PC trusted machined) , does it work or not for the new machine connection to ISE? thanks.
Thanks,
ā07-26-2024 09:02 PM
Hi if you mark the certificate as non exportable it will provide protection, but if its not TPM protected, then a malware may be able to export it.
The best protection is to use TPM and not all machine have TPM (older ones), but alteast blocking private key export in your cert template is a good fall back..
https://polansky.co/blog/tpm-backed-certificates-windows/
**Please click on Helpful button if this was useful**
ā07-28-2024 06:56 PM
Dear @ccieexpert ,
If we do not put passkey on certificate and some one will perform this case, does it work?
Thanks,
ā07-28-2024 07:15 PM
i am not understanding your question ?
some certificates you can put a password etc.. but the password is not very helpful as it can be cracked ... what i am saying if you make it non exportable is good.. The best option is to use non exportable with TPM for best security ..
**Please click on Helpful button if this was useful**
you
ā07-28-2024 07:27 PM - edited ā07-28-2024 07:28 PM
OK understand. thanks.
ā07-28-2024 07:36 PM
Your welcome:)
**Please dont forget to rate as helpful and also accept as solution if this was indeed helpful**
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide