3 ms·
Why wouldn't you be able to export the key? Is this something that is "enforced" by the user interface of some browsers?
by slrz 9y ago
Why wouldn't you be able to export the key? Is this something that is "enforced" by the user interface of some browsers?
- parliament32 9y agoThere's a flag that can be set (I don't remember if it's in the cert itself or during the import process) that makes the key un-exportable. The idea is each cert identifies a device. There's no reason to not just issue one cert per device, especially if you make the enrollment process fairly painless. If a user loses their phone, it's very nice to not have to revoke their one global cert -- just revoke the one that was used on the phone and be on your way.