- The keygen docs at Mozilla, and the keygen docs at w3 don't specify a return format after the POST. What should I return?
The reason this information is not listed is because the KeyGen element sends an SPKAC to the server and once a CSR is generated and sent to the CA an x.509 signed client certificate is to be sent back to the client that created the private key.
Essentially setting the 'Content-Type' header to 'application/x-x509-user-cert' will force the browser to load it into it's certificate store.
- After keygen is run, (see links at the bottom of this page) I don't see a certificate in my local store. Where is it?
KeyGen does not generate a certificate. It generates a private key. The public key is derived from the private key (which is not accessible from the browsers certificate store, nor through the JS engine API) then encoded as an SPKAC.
The SPKAC is to be used within a CSR (Certificate Signing Request) and an example of which would look like the example below, the more traditional CSR can be shown here, and see here for references:
OU=Snake Oil, LLC
O=Department of pricing
ST=State or province
- My understanding is that Keygen is used to create a Browser Certificate. What logical steps do I need to complete in order to finish this process?
The entire process for using a keygen element for a practical client certificate authentication within web applications is as follows:
Within an administrative panel of a web application (using an existing account) the user has the option to create a client certificate (x.509) to use for authentication. This loads the SPKAC KeyGen element along with a form providing the following attributes (everything in the parenthesis corresponds to the above CSR example):
- organizationalUnitName (OU)
- organizationName (O)
- localityName (L)
- stateOrProvinceName (ST)
- countryName (C)
- emailAddress (E)
- commonName (CN)
Once the form is provided to the server a CSR is generated. This is to then be provided to a CA (Certificate Authority) for signing.
- Once signed the client is notified to log back into the web application at which time the x.509 header 'content-type' can then be used to force the certificate into the browser's certificate store.
- As long as the web server is configured to do so, it can force the client to send any x.509 certificates for client certificate authentication. The apache web server documentation provides this information.
Some additional notes regarding the SPKAC; the challenge string provided should be unique to each users client certificate. An example of setting this based on user input would be the following snippit:
/* Gather up our form & its elements */
var form = document.getElementById("myForm")
, challenge = document.getElementById("challenge")
, spkac = document.getElementById("spkac");
/* Add an event handler to move the value from the 'challenge' input
to the keygen element challenge attribute */
form.addEventListener("blur", setSpki, true);
/* Our function which sets the challenge */
This is essential because once the signed client certificate is in the browser store anyone using that browser potentially has access to their account.
The challenge provided during the initial SPKAC should be used as a secondary form of proof of ownership for the private key corresponding to the private key used for the SPKAC.
As an example; the user logs out, closes the browser destroying the authenticated session. A malicious user sits down at the same terminal and attempts use the x.509 to provide authentication and is then prompted for the challenge.