title: C# X509Certificate2: Where to store the private key?
body: <p>I have a self-hosted WCF application, which acts as a server and I want to install/deploy it on a Windows machine.</p>
  
  <p>The application uses a self-signed certificate, which I created with makecert.exe. So the PFX, CER and PVK are there and available. Everything works fine.</p>
  
  <p>At this point of time and only for testing, the application reads the certificate and the private key from an embedded resource. That means both are compiled into the application, which is a high security risk.</p>
  
  <p>I already know, that the most common way to store this data, is the windows certificate store. And I also know, how to save and read from the windows certificate store.</p>
  
  <p>But there is something, that I still do not get:</p>
  
  <p><strong>Where do I store the private key (PVK) for the certificate (CER), so that my application is able to use the CER?</strong></p>
  
  <p>I mean, if my application can read it, then anybody, who has access to this machine, can read it. Or is this wrong?</p>
  
  <p>Do I have to take care myself or is there any "industry standard" for windows machines, to save and read the PVK?</p>