3 ms·

Last I checked it could only install from the filesystem, and not directly generate a key and install a certificate through the web. Do you have an example site

Last I checked it could only install from the filesystem, and not directly generate a key and install a certificate through the web. Do you have an example site where this works with Chrome?

jessaustin 6y ago
Has the goalpost been moved? Upthread you compared Chrome to "all popular web browsers [which] had a user interface for installing client side HTTPS certificates for user authentication". I just opened up Firefox, and found a very similar menu to Chrome's: the only option was to "import" a cert from the filesystem. I agree that we should expect more from our tools, but has any popular browser ever allowed the user to generate a new cert? If one were to do so, how would the generated cert be connected to PKI -- who would sign the cert and how would they do that?
- mortehu 6y ago
  Yes, browsers other than Chrome can generate keys, submit the public key to a site you're logged into and install the certificate you get in response (usually after a second factor verification). I am not aware of any site that still does this, so I can't show it to you. Skandiabanken in Norway used to do it before Chrome. You won't be able to see this in Firefox in any way other than visiting such a site.
  - jessaustin 6y ago
    Now I'm curious. This seems like a procedure that would need to be precisely defined. Is there a standard protocol for this? Does it have an RFC or similar I could read? If nothing else, it would be nice to have a short bumper-sticker "Chrome destroyed protocol X!" complaint.
    - mortehu 6y ago
      I did some digging, and I believe this was implemented with the <keygen> element and the generateCRMFRequest and importUserCertificate JavaScript functions. https://bugzilla.mozilla.org/show_bug.cgi?id=1088063 https://bugzilla.mozilla.org/show_bug.cgi?id=1088063
      - jessaustin 6y ago
        Thanks for the information. I don't remember ever learning anything about <keygen>. It looks as though most popular browsers (not IE; shocking!) supported it in the past, but most have now removed that support. [0] Perhaps there were some security or usability issues with this functionality? (Off the top of my head, if user certs are a single factor how do we ensure that desktops with more than one user don't install them?) ISTM the PKI world is moving to more short-lived, or even ephemeral, certificates. A complicated user-driven certificate generation process in the browser doesn't really fit that trend. [0] https://developer.mozilla.org/en-US/docs/Web/HTML/Element/keygen#Browser_compatibility https://developer.mozilla.org/en-US/docs/Web/HTML/Element/ke...
Avamander 6y ago
You can also use external enclaves/smart cards for key storage. The specific feature you're now describing doesn't really exist in any browser, mostly because it kinda negates why people'd use PKI for.

Last I checked it could only install from the filesystem, and not directly generate a key and install a certificate through the web. Do you have an example site where this works with Chrome?

jessaustin 6y ago

Has the goalpost been moved? Upthread you compared Chrome to "all popular web browsers [which] had a user interface for installing client side HTTPS certificates for user authentication". I just opened up Firefox, and found a very similar menu to Chrome's: the only option was to "import" a cert from the filesystem. I agree that we should expect more from our tools, but has any popular browser ever allowed the user to generate a new cert? If one were to do so, how would the generated cert be connected to PKI -- who would sign the cert and how would they do that?

mortehu 6y ago
Yes, browsers other than Chrome can generate keys, submit the public key to a site you're logged into and install the certificate you get in response (usually after a second factor verification). I am not aware of any site that still does this, so I can't show it to you. Skandiabanken in Norway used to do it before Chrome. You won't be able to see this in Firefox in any way other than visiting such a site.
- jessaustin 6y ago
  Now I'm curious. This seems like a procedure that would need to be precisely defined. Is there a standard protocol for this? Does it have an RFC or similar I could read? If nothing else, it would be nice to have a short bumper-sticker "Chrome destroyed protocol X!" complaint.
  - mortehu 6y ago
    I did some digging, and I believe this was implemented with the <keygen> element and the generateCRMFRequest and importUserCertificate JavaScript functions. https://bugzilla.mozilla.org/show_bug.cgi?id=1088063 https://bugzilla.mozilla.org/show_bug.cgi?id=1088063
    - jessaustin 6y ago
      Thanks for the information. I don't remember ever learning anything about <keygen>. It looks as though most popular browsers (not IE; shocking!) supported it in the past, but most have now removed that support. [0] Perhaps there were some security or usability issues with this functionality? (Off the top of my head, if user certs are a single factor how do we ensure that desktops with more than one user don't install them?) ISTM the PKI world is moving to more short-lived, or even ephemeral, certificates. A complicated user-driven certificate generation process in the browser doesn't really fit that trend. [0] https://developer.mozilla.org/en-US/docs/Web/HTML/Element/keygen#Browser_compatibility https://developer.mozilla.org/en-US/docs/Web/HTML/Element/ke...

Avamander 6y ago

You can also use external enclaves/smart cards for key storage. The specific feature you're now describing doesn't really exist in any browser, mostly because it kinda negates why people'd use PKI for.