Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

Most companies use IE with an ActiveX control to create a CSR and submit it to the CA for approval.

Since many browsers either block or don't support ActiveX controls, how can I enroll them using a Microsoft-based CA?

In other words how can I issue browser certificates (for user authentication) from a Microsoft-based CA to Chrome,Firefox, Safari, and possibly Opera users?

share|improve this question
What do you mean with "Microsoft-based CA"? Chrome uses the Windows Cert Store, so should be aware of all Microsoft Root Certs. – ordag Mar 4 '12 at 16:49
@ordag - Updated – makerofthings7 Mar 4 '12 at 18:58
The question should be updated to .."Most companies use IE with an ActiveX control to create a CSR and submit it to the CA for approval." – Brennan Apr 4 '12 at 21:02

2 Answers

up vote 1 down vote

Certificate Signing Requests (CSRs) are a standard format, as are signed certificates. Without that standardization, the entire certificate system would be (more) horribly broken.

Any certificate signed by the CA and placed on a computer with the corresponding private key will be valid. Where they're generated is essentially irrelevant.

If you're already using IE with Active X for the process, then just export the resulting certificate and key. If not, make your own key and signing request with OpenSSL.

For import / export, see this also.

share|improve this answer
up vote 0 down vote

Are you wanting to use Microsoft Certificate Services on IIS to grant certificates in response to Certificate Signing Requests (PKCS #10)? The client, instead of using the ActiveX control in Internet Explorer, can use OpenSSL's "req" command to issue a certificate signing request to Microsoft Certificate Services.

share|improve this answer
Will that work if the workstation is on the internet, not domain trusted, and some part of the CA (IIS?) is exposed via ssl? – makerofthings7 Mar 5 '12 at 14:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.