Since Windows 8, it is possible to protect the private keys of certificates with a Trusted Platform Module (TPM), if one is present
. This makes the key non-exportable - even with tools like mimikatz.
However, it is not obvious at first glance that it cannot be guaranteed that a TPM is really used. It is true that no request via the Microsoft Management Console or autoenrollment is possible
if the computer does not have a TPM.
However, the configuration in the certificate template is only a default setting for the client. When a certificate is requested, the certification authority will not explicitly check whether a Trusted Platform Module was really used
.
To ensure that the private key of a certificate request has really been protected with a Trusted Platform Module, only the TPM Key Attestation remains.
Continue reading "Configuring the Trusted Platform Module (TPM) Key Attestation"
