Most companies use IE with an ActiveX control to create a CSR and submit it to the CA for approval.

Since many browsers either block or don't support ActiveX controls, how can I enroll them using a Microsoft-based CA?

In other words how can I issue browser certificates (for user authentication) from a Microsoft-based CA to Chrome,Firefox, Safari, and possibly Opera users?

  • What do you mean with "Microsoft-based CA"? Chrome uses the Windows Cert Store, so should be aware of all Microsoft Root Certs.
    – ordag
    Commented Mar 4, 2012 at 16:49
  • @ordag - Updated Commented Mar 4, 2012 at 18:58
  • The question should be updated to .."Most companies use IE with an ActiveX control to create a CSR and submit it to the CA for approval."
    – Brennan
    Commented Apr 4, 2012 at 21:02

3 Answers 3


Certificate Signing Requests (CSRs) are a standard format, as are signed certificates. Without that standardization, the entire certificate system would be (more) horribly broken.

Any certificate signed by the CA and placed on a computer with the corresponding private key will be valid. Where they're generated is essentially irrelevant.

If you're already using IE with Active X for the process, then just export the resulting certificate and key. If not, make your own key and signing request with OpenSSL.

For import / export, see this also.


Are you wanting to use Microsoft Certificate Services on IIS to grant certificates in response to Certificate Signing Requests (PKCS #10)? The client, instead of using the ActiveX control in Internet Explorer, can use OpenSSL's "req" command to issue a certificate signing request to Microsoft Certificate Services.

  • Will that work if the workstation is on the internet, not domain trusted, and some part of the CA (IIS?) is exposed via ssl? Commented Mar 5, 2012 at 14:33

ActiveX are not supported by modern browsers. Browser Extension may be used to Enroll Certificate (Generate CSR) and Download Certificate in Windows Certificate Store or Smartcard or USB Token. CSR generated using Browser Javascript API genCSR may be posted to CA Server for certificate generation or to your server if you want self signed certificate. Certificate received back from the server may be passed to ImportCer to import in the certificate store, smartcard or usb token.

API Available in Signer.Digital Browser Extension are:

  1. Detect connected smartcard: (Autodetect connected Smartcard or USB Token)

SignerDigital.getPCSCReaders(onlyConnected = true) //List PCSC Readers, set paramater to false if you want to list all available readers


        try {
            var SmartcardReaders = await SignerDigital.getPCSCReaders();
            var SCReaders = JSON.parse(SmartcardReaders);
            if (SCReaders.length > 0)
                for (var i = 0; i < SCReaders.length; i++) {
                    var SCName = SignerDigital.getSCNameByReaderName(SCReaders[i]);
                    $("#selSmartcard").append(new Option(SCName));
                $('#selSmartcard option:eq(1)')
        catch (ErrorMsg) {
  1. Generate CSR: (for Certificate Enrollment in Cert Store, Smartcard or USB Token)

SignerDigital.genCSR(PKCS11Lib, certSubject, certIssuer, keyBits = 2048, hasgAlgorithm = "SHA256", forceUserPinChangeIfDefault = false)

  1. Import / Download Certificate (Import User Certificate and Trust Certificate Chain to Cert Store, Smartcard or USB Token)

SignerDigital.importCer(PKCS11Lib, b64Payload, certIssuer)

Json Model for b64Payload param above is: (Base64 of Json of below model)

public class ImportCertPL
    public string UserCertB64 ;
    public List<string> TrustChainB64;

Generate CSR and Import Certificate api uses PKCS#11 library of smartcard or usb token for combability across OS. Thus, requires smartcard drivers to be installed on user's windows pc before using these JavaScript API.

Other useful properties and methods in Signer.Digital Extension

  1. SignerDigital.OSName

  2. SignerDigital.OSSupported

  3. SignerDigital.getPkcsLibByProvider(ProviderName)

  4. SignerDigital.getSCNameByReaderName(ReaderName) //obtained using promise getPCSCReaders() as listed in point 1 above.

  5. SignerDigital.getPkcsLibBySCName(SCName)

You may refer to SO Answer for other Certificate, Signing and Encryption/Decryption JavaScript APIs. These API uses Windows CSP and on Linux uses PKCS#11.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .