Okay that's plenty of background info. So why not expose something like p12U_ImportPKCS12Object() to the web? You could generate and store the key and cert on t

Okay that's plenty of background info. So why not expose something like p12U_ImportPKCS12Object() to the web? You could generate and store the key and cert on the user's mobile device and have an app for pushing the cert via Bluetooth (which has a web api). Let the user and web server app sort out what his handle will be. It can be treated as a separate problem (however interesting it might be!).