4 ms·
Yes, browsers other than Chrome can generate keys, submit the public key to a site you're logged into and install the certificate you get in response (usually a
by mortehu 6y ago
Yes, browsers other than Chrome can generate keys, submit the public key to a site you're logged into and install the certificate you get in response (usually after a second factor verification). I am not aware of any site that still does this, so I can't show it to you. Skandiabanken in Norway used to do it before Chrome.
You won't be able to see this in Firefox in any way other than visiting such a site.
- jessaustin 6y agoNow I'm curious. This seems like a procedure that would need to be precisely defined. Is there a standard protocol for this? Does it have an RFC or similar I could read? If nothing else, it would be nice to have a short bumper-sticker "Chrome destroyed protocol X!" complaint.
- mortehu 6y agoI did some digging, and I believe this was implemented with the <keygen> element and the generateCRMFRequest and importUserCertificate JavaScript functions. https://bugzilla.mozilla.org/show_bug.cgi?id=1088063 https://bugzilla.mozilla.org/show_bug.cgi?id=1088063
- jessaustin 6y agoThanks for the information. I don't remember ever learning anything about <keygen>. It looks as though most popular browsers (not IE; shocking!) supported it in the past, but most have now removed that support. [0] Perhaps there were some security or usability issues with this functionality? (Off the top of my head, if user certs are a single factor how do we ensure that desktops with more than one user don't install them?) ISTM the PKI world is moving to more short-lived, or even ephemeral, certificates. A complicated user-driven certificate generation process in the browser doesn't really fit that trend. [0] https://developer.mozilla.org/en-US/docs/Web/HTML/Element/keygen#Browser_compatibility https://developer.mozilla.org/en-US/docs/Web/HTML/Element/ke...