在浏览器中生成客户端证书并在服务器上签名
是否可以在浏览器中请求生成客户端密钥对并将公钥发送到服务器 CA 进行透明签名？然后在用户的浏览器中安装签名的证书？
场景：
- 用户打开 https://examle.com/ 网页，服务器身份已验证
- 用户请求创建帐户
- 密钥对在用户的浏览器中生成，并且不向服务器/CA透露
- 公钥发送到服务器进行签名
- 服务器对密钥进行签名并生成证书
- 证书发送到客户端并与私钥一起安装在浏览器中
下次客户端连接到服务器时，将根据客户端证书验证其身份。
如果服务器可以强制/提示客户端使用密码加密来保护其私钥，那就太好了。
我见过在线银行使用 java applet 来完成此任务。是否可以使用本机浏览器功能来做到这一点？ Apache/PHP 或 Node.js 解决方案将受到欢迎。
Is it possible to request generation of client keypair in browser and send the public key to the server CA to be signed transparently? Then installing the signed certificate in user's browser?
Scenario:
- User opens https://examle.com/ web page, server identity is verified
- User requests an account creation
- Keypair is generated in user's browser and not revealed to server/CA
- Pubkey is send to server for signing
- Server signes the key and generates certificate
- Certificate is sent to client and installed in browser along with private key
Next time client connects to server, his identity is verified based on client certificate.
It would be nice if server could force/hint the client to protect his private key using password encryption.
I've seen online banking using java applet for this task. Is it possible to do it using native browser capabilites? Apache/PHP or Node.js solution would be welcome.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
是的，这是可能的。但没有跨浏览器的解决方案。
X509Enrollment.CX509EnrollmentWebClassFactory或CEnroll.CEnroll等 ActiveX 控件，具体取决于它是在 Windows XP 还是 Vista/7 上运行。这将生成 PKCS#10 证书请求（您可能需要将其包含在传统分隔符之间。CSR）。 （尽管它支持注册机 //github.com/harbulot/webidrepository/blob/master/core/src/main/resources/uk/ac/manchester/rcs/bruno/webidrepository/htdocs/crosskeygen.js" rel="noreferrer">这里是一个示例脚本，它应该为 ActiveX 或 Keygen 完成大部分工作。
当服务器返回证书时（可能稍后），浏览器应将其导入到其存储中并关联。它带有在请求时生成的私钥。
如何保护私钥将取决于浏览器或底层证书存储机制。例如，在 Firefox 中，安全设备上应该有一个主密码。
在服务器端，您可以使用各种工具实现自己的CA。 OpenSSL 和 BouncyCastle 可以处理 PKCS#10 和 SPKAC。这是 基于 BouncyCastle 的示例（与上面的脚本相关），以及 CRMF 的一些代码。
如果您想要现成的解决方案，您可能会对 OpenCA 感兴趣。
Yes, it's possible. There are no cross-browser solutions, though.
X509Enrollment.CX509EnrollmentWebClassFactoryorCEnroll.CEnroll, depending on whether it's running on Windows XP or Vista/7. This will generate a PKCS#10 certificate request (which you may need to wrap between the traditional delimiters.<keygen />tag. It's a legacy Netscape tag, not officially HTML before, but it has made it into HTML 5 (although MS have said they wouldn't support it in their implementations). This will generate a SPKAC structure (similar to a CSR).Here is an example script that should do most of the work for ActiveX or Keygen.
When the server sends a certificate in return (possibly later), the browser should import it into its store and associate it with the private key it had generated at the time of the request.
How the private key is protected will depend on the browser or underlying certificate store mechanism. In Firefox, there should be a master password on the security device, for example.
On the server side, you can implement your own CA using various tools. OpenSSL and BouncyCastle can handle PKCS#10 and SPKAC. Here is a BouncyCastle-based example (associated with the script above), and some code for CRMF.
If you want a ready-made solution, you may be interested in something like OpenCA.