Please see our important announcement.

Securing your Windows Service

The answer I think is pretty easy if you're running a web site or Windows Service. Create an account for a the application and install the certificates in that users store and run the web app or service as that user.

This will hide your cert from other uses of that box, unless they have the login credentials of course. Once the certificates are installed, anyone can create a policy from that certificate and use it if they have access to that cert store.

You may think that putting the cert in LocalMachine is a good idea, but anyone who has access to the machine can use that account, so think about that before deploying.

- Robbie