Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Suggestions on easy distribution/installation of self signed certificates & roots to mobile devices

I am a developer at a government agency in a developing country that has a web application with a number of web-forms for data entry through which customers can submit "electronic forms" to the agency.

For legal purposes, the forms have to be digitally signed when submitted to be considered valid. This is accomplished at the moment via a client side Digital Certificate installed in the customers PC's browser. If forms are not digitally signed then alternatively customers have to submit the forms manually with a physical signature.

The web application at the moment has ActiveX controls that restricts it to only be capable of running on Internet Explorer browsers. They however want to upgrade it to a HTML5/Javascript application that can work on ios and android mobile devices.

Funds are short so they have a open source Certificate Authority through which they generate self signed certificates and email them to customers for installation in the customers browsers on PC's.

The distribution and installation of certificates on PC's right now however is a real hassle at times, involving many emails and phone calls as the customers are not very technically adept beyond typical word processing and excel usage - which is perfectly understandable but presents a support challenge. Then from what I have read, getting client side digital certificates installed in mobile devices is even harder...involving the installation in a keystore.

Are there any suggestions on an easy and low hassle way for the digital certificates to be installed to end customers with mobile devices. I am looking for technical suggestions to reduce the effort for end customers (e.g. just click on a link)...which I know may increase the necessary infrastructure or programming effort on the issuing end to accomplish all of that seamlessly.

I am also aware that different devices/operating systems may need custom methods (i.e. one method for android, and another for ios).

Any suggestions would be most welcome.

share|improve this question
1  
I don't see why ActiveX is required or why on earth you think that you need to taint the PKI used by every machine subject to this "service". This strikes me as such an serious design fail, that you will probably better off starting from scratch. –  Rook Dec 2 '13 at 1:20
1  
@Rook - Given that HTML 5's keygen enrollment is a fail Microsoft created a browser object to make it better in early 2000's. It's likely that his deployment is based on this object. –  makerofthings7 Dec 2 '13 at 1:26
    
for what it's worth, Microsoft created a browser plugin (XMLHTTPRequest) that later became the foundation of all AJAX across all browsers. It's a shame that nobody else adopted this standard or created anything better. –  makerofthings7 Dec 2 '13 at 1:28
    
@Rook - The ActiveX is used in the existing version of the application (a very old application) which only works on Microsoft based PC's. This is the limiting constraint for which they seek an upgrade that can work on mobile devices. ActiveX is absolutely going away in the new design. However the question is what to replace it with that can "seamlessly" install digital certificates in mobile devices. –  darz Dec 2 '13 at 4:01
add comment

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.