4 ms·

There is a move afoot among Web browser developers to remove an authentication mechanism that many enterprises depend on: SSL/TLS with X.509 client certificates

• geofft 11y ago
  If you've got a server you're comfortable typing passwords at (which you probably are, if you're using <keygen>), you ought to be able to set up some sort of server-based authentication like Shibboleth or OpenID Connnect (which is really more of an OAuth than an OpenID...). If you want something that matches X.509 client certs closely, WebCrypto + localStorage + either an extension or a static site (to host the JS that can get access to your localStorage and sign a site-specific token) ought to work, though I'm not sure I know of any out-of-the-box implementations. Mozilla Persona is essentially this, although since it's a somewhat different use case it's probably not an out-of-the-box thing. Google would probably encourage you to use FIDO UAF. https://fidoalliance.org/specifications/overview/ https://fidoalliance.org/specifications/overview/