I am working on an internal ERP for my company. The portal is written in PHP and the current purchasing process is the following:

  • Create a new order on the ERP portal
  • Print the order (PDF)
  • Ask for signature (manual ones)
  • Scan the order
  • Attach the scanned file to the digital order

Instead of this cumbersome process, I would like to use the employees certificates (Installed for each user) to generate a digital signature directly on the web portal. Of course, the private key must remain safely stored by Windows. This new process is much simpler, and more secure than a scanned document

  • Create a new order on the ERP portal
  • Concerned managers receive a signature request
  • They approve the request (this is the tricky part)

Theoretically I just need to do this computation:

 $i = $order->id
 $a = $order->id + $order->integrityHash() 
 $b = sign($a, $private_key) // Done on the client side
 $order->signature = $b

My main issue is how can I securely execute:

 $b = sign($a, $private_key) 

With a user certificate stored in Windows 10 under Certificates - Current User - Personal - Certificates to sign JavaScript data in my Chrome browser.

I am thinking of these possible solutions:

  1. Use an existing solution
  2. Write a Chrome plugin

Any advise?


You may look at this question

In C# you will need to use the Windows Store:

using System.Security.Cryptography.X509Certificates;
using System.Security.Cryptography;

namespace ConsoleApp1
    class Program
        static void Main(string[] args)
            X509Store store = new X509Store(StoreName.My, StoreLocation.CurrentUser);


            foreach (var cert in store.Certificates)
                string desc = cert.GetNameInfo(X509NameType.SimpleName, true);
                if (desc.Contains("WISeKey"))
                    RSA pk = cert.GetRSAPrivateKey();                    
                    byte[] buffer = Encoding.Default.GetBytes("Hello World ... !");
                    byte[] signature = pk.SignData(buffer, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.