You’ve now set up a KeePass database that can only be opened if you provide a correct password and also a digital certificate. Select a certificate to use to protect your key file.

Choose a place to save your encrypted key file (which can only be “unlocked” using your password and certificate).

Here you should specify a Master Password and change the Key file / provider to Certificate-protected key.

You should now see the Create Composite Master Key page.

Create a new database (File->New) and tell KeePass where to place this new database. If you already have a digital certificate (preferably loaded on a Smartcard) then you can skip this step. I outline the steps of creating a new certificate in another article Securing OpenSSH with WWPass PassKey in Step #1. If you don’t already have a certificate to use you can generate one using OpenSSL. Once you have downloaded the plugin, copy the PLGX file into your KeePass software directory (where your KeePass.exe is located). You can get the CertKeyProvider plugin from the KeePass Plugin Download Page. Getting Started Download KeePass (if you’re not already using it) I will show you how to protect your KeePass password manager with true Two-Factor Authentication (2FA) using something you have and something you know. On top of that security, you should also be able to provide a password that you know to go with it. The idea is that you will generate a secure (and lengthy) private key and use that key to encrypt another key and use that final key as your “password” to unlock your password manager. Public Key Infrastructure (PKI) digital certificates are the answer.

Talk about putting all of your eggs in one (very insecure) basket. Inversely, Password Managers solve the problem of having to remember thousands of passwords to different websites but the security of these managers are typically sub-par and often require a single password (“master password”) to access your list of passwords.

More progressive websites have started to allow users to log-in with their existing passwords but tack on a “second factor” authentication such as an SMS/text message code being sent to your phone or an e-mail with a One-Time Password (OTP). Unfortunately, not every website on the internet takes security all that seriously and still requires users to sign-up and authenticate with usernames and passwords.

Keepassx 2