I am working on an internal ERP for my company. The portal is written in PHP and the current purchasing process is the following:

  • Create a new order on the ERP portal
  • Print the order (PDF)
  • Ask for signature (manual ones)
  • Scan the order
  • Attach the scanned file to the digital order

Instead of this cumbersome process, I would like to use the employees certificates (Installed for each user) to generate a digital signature directly on the web portal. Of course, the private key must remain safely stored by Windows. This new process is much simpler, and more secure than a scanned document

  • Create a new order on the ERP portal
  • Concerned managers receive a signature request
  • They approve the request (this is the tricky part)

Theoretically I just need to do this computation:

 $i = $order->id
 $a = $order->id + $order->integrityHash() 
 $b = sign($a, $private_key) // Done on the client side
 $order->signature = $b

My main issue is how can I securely execute:

 $b = sign($a, $private_key) 

With a user certificate stored in Windows 10 under Certificates - Current User - Personal - Certificates to sign JavaScript data in my Chrome browser.

I am thinking of these possible solutions:

  1. Use an existing solution
  2. Write a Chrome plugin

Any advise?

1 Answer 1


You may look at this question

In C# you will need to use the Windows Store:

using System.Security.Cryptography.X509Certificates;
using System.Security.Cryptography;

namespace ConsoleApp1
    class Program
        static void Main(string[] args)
            X509Store store = new X509Store(StoreName.My, StoreLocation.CurrentUser);


            foreach (var cert in store.Certificates)
                string desc = cert.GetNameInfo(X509NameType.SimpleName, true);
                if (desc.Contains("WISeKey"))
                    RSA pk = cert.GetRSAPrivateKey();                    
                    byte[] buffer = Encoding.Default.GetBytes("Hello World ... !");
                    byte[] signature = pk.SignData(buffer, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .