Certificate store only valid for one machine

Question

Hello all,
I'm new in the world of digital certificates and I've found one little big problem that is driving me crazy. I'm using a certificate to establish a SSL connection between a web server and a client browser. This certificate (I'm using Tomcat) is inside a keystore (a jks file). The problem is that this certificate is really important, and the people that provides it does not want it to be used by anyone, so they don�t want anyone to be able to export the private key inside it.
As I have to include the password to the certificate and the store is a config file, if someone enters in the system as the tomcat user and copies the jks file and also copies the password, will have all the control over the certificate, and will can use it.
The only solution to this problem I can think of is, and I don�t know if it is possible, is to include the certificate in a computer-dependant keystore. Is there a way to do it? Is there any other method to prevent someone with the privileges of the tomcat user to use the certificate?
Thank you all in advance :)

Answer 1

If I understand your problem correctly, then I don't think there is anything you can do short of using a hardware security module (HSM). And even an HSM is not a magical device that can prevent you from using it insecurely. For example, you suggest that you cannot prevent an unauthorized user from logging on with the same account as Tomcat. In that case, even if the private key never leaves the HSM it is still available for private-key operations, a severe weakness. Thus, at a minimum, you must at least ensure that only authorized users have access to the private key regardless of how it stored.
It is certainly possible to create a computer-dependent keystore, but all such schemes that I am aware are essentially just obfuscation.