title: Where to store X509 certificate for Windows service?
body: <p>I have a Windows service that will normally be run using the Local System Account (although in some installations it may as a specific user account).</p>
  
  <p>The service is using WCF, with communication secured using X509 certificates.</p>
  
  <p>My question is, where is the best place to store the certificate (and private key)?</p>
  
  <p>If using a certificate store is the best approach, which one should I use to ensure that only Administrators and the service can access the private key?</p>
  
  <p>Alternatively, a simple option would be to simply store both as a PFX file on disk, and use ACLs to ensure only Administrators and the service have access to it. What are the pros and cons of this approach vs using a certificate store?</p>
  
  <p><strong>EDIT</strong>
  To clarify, I am using C# with the .NET Framework 3.5</p>