Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Most companies use IE with an ActiveX control to create a CSR and submit it to the CA for approval.

Since many browsers either block or don't support ActiveX controls, how can I enroll them using a Microsoft-based CA?

In other words how can I issue browser certificates (for user authentication) from a Microsoft-based CA to Chrome,Firefox, Safari, and possibly Opera users?

share|improve this question
What do you mean with "Microsoft-based CA"? Chrome uses the Windows Cert Store, so should be aware of all Microsoft Root Certs. – ordag Mar 4 '12 at 16:49
@ordag - Updated – LamonteCristo Mar 4 '12 at 18:58
The question should be updated to .."Most companies use IE with an ActiveX control to create a CSR and submit it to the CA for approval." – Brennan Apr 4 '12 at 21:02

Certificate Signing Requests (CSRs) are a standard format, as are signed certificates. Without that standardization, the entire certificate system would be (more) horribly broken.

Any certificate signed by the CA and placed on a computer with the corresponding private key will be valid. Where they're generated is essentially irrelevant.

If you're already using IE with Active X for the process, then just export the resulting certificate and key. If not, make your own key and signing request with OpenSSL.

For import / export, see this also.

share|improve this answer

Are you wanting to use Microsoft Certificate Services on IIS to grant certificates in response to Certificate Signing Requests (PKCS #10)? The client, instead of using the ActiveX control in Internet Explorer, can use OpenSSL's "req" command to issue a certificate signing request to Microsoft Certificate Services.

share|improve this answer
Will that work if the workstation is on the internet, not domain trusted, and some part of the CA (IIS?) is exposed via ssl? – LamonteCristo Mar 5 '12 at 14:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.