Re: On the future of <keygen> and application/x-x509-*-cert MIME handling

Hi,

> This cements my opinion on their fate.  These are not just old and
> crufty, they are actively harmful.  They can't be removed soon enough.

Is there an alternate workflow that can replace it?

The keygen tag is immensely useful to roll out client certificates to users:

1. have user call or visit, authenticate them
2. give them a one time password
3. direct them to a web page containing a <keygen> and a text field for the password
4. on submit, sign their key with the organization certificate, and return the cert

I use this method basically in every small office installation I do -- it is more than sufficient security, because the applicant is usually directly known to the person maintaining the CA, and is really uncomplicated to use even for nontechnical users.

The most difficult step at present is having the user copy the certificate from Firefox to Thunderbird, for IMAP and SMTP authentication (outgoing mail is SMTP+STARTTLS, with a rule that whitelisted client certificates get relay access).

If that were to be dropped, what would I use to replace it? 

   Simon