Most companies use IE with an ActiveX control to create a CSR and submit it to the CA for approval.
Since many browsers either block or don't support ActiveX controls, how can I enroll them using a Microsoft-based CA?
In other words how can I issue browser certificates (for user authentication) from a Microsoft-based CA to Chrome,Firefox, Safari, and possibly Opera users?
Certificate Signing Requests (CSRs) are a standard format, as are signed certificates. Without that standardization, the entire certificate system would be (more) horribly broken.
Any certificate signed by the CA and placed on a computer with the corresponding private key will be valid. Where they're generated is essentially irrelevant.
If you're already using IE with Active X for the process, then just export the resulting certificate and key. If not, make your own key and signing request with OpenSSL.
Are you wanting to use Microsoft Certificate Services on IIS to grant certificates in response to Certificate Signing Requests (PKCS #10)? The client, instead of using the ActiveX control in Internet Explorer, can use OpenSSL's "req" command to issue a certificate signing request to Microsoft Certificate Services.
ActiveX are not supported by modern browsers. Browser Extension may be used to Enroll Certificate (Generate CSR) and Download Certificate in Windows Certificate Store or Smartcard or USB Token. CSR generated using Browser Javascript API genCSR may be posted to CA Server for certificate generation or to your server if you want self signed certificate. Certificate received back from the server may be passed to ImportCer to import in the certificate store, smartcard or usb token.
API Available in Signer.Digital Browser Extension are:
SignerDigital.getPCSCReaders(onlyConnected = true) //List PCSC Readers, set paramater to false if you want to list all available readers
Example:
try {
var SmartcardReaders = await SignerDigital.getPCSCReaders();
var SCReaders = JSON.parse(SmartcardReaders);
console.log(SmartcardReaders);
console.log(SCReaders.length);
if (SCReaders.length > 0)
{
$("#selSmartcard").empty();
for (var i = 0; i < SCReaders.length; i++) {
var SCName = SignerDigital.getSCNameByReaderName(SCReaders[i]);
$("#selSmartcard").append(new Option(SCName));
}
$('#selSmartcard option:eq(1)')
}
}
catch (ErrorMsg) {
alert(ErrorMsg);
}
SignerDigital.genCSR(PKCS11Lib, certSubject, certIssuer, keyBits = 2048, hasgAlgorithm = "SHA256", forceUserPinChangeIfDefault = false)
SignerDigital.importCer(PKCS11Lib, b64Payload, certIssuer)
Json Model for b64Payload param above is: (Base64 of Json of below model)
public class ImportCertPL
{
public string UserCertB64 ;
public List<string> TrustChainB64;
}
Generate CSR and Import Certificate api uses PKCS#11 library of smartcard or usb token for combability across OS. Thus, requires smartcard drivers to be installed on user's windows pc before using these JavaScript API.
Other useful properties and methods in Signer.Digital Extension
SignerDigital.OSName
SignerDigital.OSSupported
SignerDigital.getPkcsLibByProvider(ProviderName)
SignerDigital.getSCNameByReaderName(ReaderName) //obtained using promise getPCSCReaders() as listed in point 1 above.
SignerDigital.getPkcsLibBySCName(SCName)
You may refer to SO Answer for other Certificate, Signing and Encryption/Decryption JavaScript APIs. These API uses Windows CSP and on Linux uses PKCS#11.
