1
$\begingroup$

IBM (now HCL) Domino has since way back a complete procedure to issue X509 client certificate as a login option to a webserver. Back in 2010-ish it worked fine in both Firefox and Internet Explorer. The handling has 4 steps

  1. Acceptance of Root certificate, CA (usually self-signed from Domino)
  2. Request client certificate, with PrivateKey to local certificate store and PublicKey sent to the server
  3. Domino internal issuing of the certificate and insert in users credentials on the server.
  4. Sending certificate to the user and manually installation of that certificate together with local PrivateKey

But time has passed and web browsers support this solution much less. The problem that has emerged over time is step 2 in the process. The browsers work worse over time for various reasons.

  • Firefox used the HTML tag KEYGEN which is no longer supported (so it is gone)
  • IE has been using XEnroll and Certenroll (still working but IE is on the way out)
  • Chrome doen't work
  • Edge does not have access to use XEnroll/Certenroll and does not work.

I know that nowadays there are much better login methods via SAML, idp, OTP etc etc. But this is what is in place now and will hopefully work for a few more years before it has to be completely replaced. As it is now with IE as the only option, however, customers are putting IE down because it soon lacks support from MS.

Hope that someone can suggest some type of API, javascript that can replace generating KeyPair in the same way as KEYGEN, XEnroll/Certenroll done before, i.e. write down PrivateKey locally and send with PublicKey to the web server. In this way, most of the solutions could be run a little longer while new solutions are built.

With the right solution, it might even be less depending on the user's browser.

Improve this question
$\endgroup$
2
  • $\begingroup$ Key generation is not so much a problem. Key management is. I'd not trust a browser to securely generate & store a private key. Why not simply upload a PKCS#10 Certificate Signing Request (CSR) where you keep the private key secure? The authentication mechanism can remain the same (for server certs you obviously want to check that the server is managed by the entity requesting the certificate). $\endgroup$
    – Maarten Bodewes ♦
    Dec 15, 2022 at 22:09
  • $\begingroup$ @MaartenBodewes: This question can be better answered on the Security SE. Can you please move it there? $\endgroup$
    – mentallurg
    Dec 17, 2022 at 9:28

1 Answer 1

Reset to default
1
$\begingroup$

Modern browsers support Web Crypto API and SubtleCrypto interface. See the compatibility matrix. In particular, it is possible with JavaScript to generate keys, import and export them, sign and verify signatures.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.