The keygen tag is used to make browsers generate private keys and POST the resulting CSR to the server, which can then issue a certificate. It's now been deprecated, for rather stupid reasons but that's besides the point.

So, what are the alternatives for a browser to obtain a client cert?

up vote 7 down vote accepted

In this post in the chromium forum there are alternatives mentioned

Within the browser space, alternatives exist such as:

  • Use the device's native management capabilities if an enterprise use case. On Windows, this is Group Policy. On iOS/Android, this is the mobile device management suites. On OS X, this is Enterprise settings. On ChromeOS, there is chrome.enterprise.platformKeys [11] for enterprise-managed extensions.
  • Use WebCrypto to implement certificate enrollment, then deliver the certificate and (exported) private key in an appropriate format for the platform (such as PKCS#7) and allow the native OS UI to guide users through installation of certificates and keys.

WebCrypto is supported by many browsers: [link]

And you can use openpgp.js and other solutions. [openpgp.js]

Here are some examples.

You can also generate a CSR:

Some library for generating CSRs:

Here is an example with PKIjs for generating selfsigned X509 certs + the keypairs:

The generateKey() function creates keypairs.

  • Do you have an example of implementing the functionality of <keygen> using WebCrypto ? As far as OpenPGP.js goes, it's definitely not what I'm looking for. – André Borie Dec 3 '15 at 15:35
  • @MikeOunsworth thanks for the hint and formatting my answer. The API specification mentions the functions for generating a CSR and I linked also a library for generating CSR using WebCrypto. – Daniel Ruf Dec 3 '15 at 17:05
  • I know. You just can generate a CSR with WebCrypto but you have to submit it manually. And a private key is required. There are other tools for clients to submit a CSR. OpenSSL implementations (serverside) can parse the CSR and create the final certificate. – Daniel Ruf Dec 3 '15 at 17:26
  • Where do you read this? I just see this question: "So, what are the alternatives for a browser to obtain a client cert?" – Daniel Ruf Dec 3 '15 at 17:31
  • The examples from GitHub show how a keypair can be generated. And tere is generateKey(). So what is missing? The question is not quite clear. – Daniel Ruf Dec 3 '15 at 17:41

The WebCrypto API is currently not an alternative for the keygen tag, as confirmed by the WebCrypto API spec:

This API, while allowing applications to generate, retrieve, and manipulate keying material, does not specifically address the provisioning of keys in particular types of key storage, such as secure elements or smart cards. This is due to such provisioning operations often being burdened with vendor-specific details that make defining a vendor-agnostic interface an unsuitably unbounded task. Additionally, this API does not deal with or address the discovery of cryptographic modules, as such concepts are dependent upon the underlying user agent and are not concepts that are portable between common operating systems, cryptographic libraries, and implementations.

I just wrote a web-based client certificate utility that is entirely cross browser (does require modern browsers tho). It allows users to do single-password authentication and single-click auth. Your keys get encrypted with your single password, so you're a bit safer than <keygen> keys (since those aren't password protected). Users will eventually be able to create and use multiple identities that can be different for different websites, or even switched between for the same site. Also, its controlled entirely through javascript, so you can auth someone whenever you want, not just before page-load.

Check it out here:

  • Well your solution also uses the WebCrypto API. The question was about official alternatives for keygen and the W3C docs mention WebCrypto for this purpose. How it is implemented is another thing. – Daniel Ruf Apr 10 '16 at 15:45

At this point (April 2017) I had to create a native app. Only FireFox works with the keygen tag, and, no matter what javascript library you may find you will not be able to import the certificate to Windows so it can be used from Chrome, for example.

Your Answer


By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.