Re: On the future of <keygen> and application/x-x509-*-cert MIME handling

The short answer is "No, there is no comparably automated workflow for
setting HTTPS client certificates."

The slightly longer answer is: You can still automate issuing certificates
to clients in a way that the client's private key never leaves the host by
using something like WebCrypto and pki.js.  Then you can have the user
download the cert and private key and install them.


On Wed, Oct 14, 2015 at 5:38 AM, <[email protected]> wrote:

> Hi,
>
> > This cements my opinion on their fate.  These are not just old and
> > crufty, they are actively harmful.  They can't be removed soon enough.
>
> Is there an alternate workflow that can replace it?
>
> The keygen tag is immensely useful to roll out client certificates to
> users:
>
> 1. have user call or visit, authenticate them
> 2. give them a one time password
> 3. direct them to a web page containing a <keygen> and a text field for
> the password
> 4. on submit, sign their key with the organization certificate, and return
> the cert
>
> I use this method basically in every small office installation I do -- it
> is more than sufficient security, because the applicant is usually directly
> known to the person maintaining the CA, and is really uncomplicated to use
> even for nontechnical users.
>
> The most difficult step at present is having the user copy the certificate
> from Firefox to Thunderbird, for IMAP and SMTP authentication (outgoing
> mail is SMTP+STARTTLS, with a rule that whitelisted client certificates get
> relay access).
>
> If that were to be dropped, what would I use to replace it?
>
>    Simon
> _______________________________________________
> dev-security mailing list
> [email protected]
> https://lists.mozilla.org/listinfo/dev-security
>