JGridstart/Browser certificate installation

Installing a certificate into a browser can be done in a lot of ways, some of which are cumbersome for the user, others are a lot of work to implement for the developer. jGridStart is a Java application, so the starting point is to install a client certificate and private key from Java into browsers' keystores.

It appears that each web browser either uses the system's keystore (like Internet Explorer), or has its own keystore (like Firefox). Each type of keystore then needs an implementation to access it. This has currently been implemented in jGridstart using the browsers install package. This takes care of detecting available web browsers, opening web pages in them, and installing certificates. browsertool is a program that lets you do all this from the command-line (see jGridstart source code).

Some possible approaches for installing certificates are discussed below.

	Mozilla/Firefox	Internet Explorer	Safari
manual import of PKCS#12	V	V	V	cumbersome for user
open PKCS#12 in browser		V	?
pk12util	V		?	browser must be closed
cryptext		V
XPCOM	V
certtool			V

Manual import of PKCS#12 file within browser

This is a method that always works: jGridStart exports a PKCS#12 file which the user imports from the browser. This can be a fairly complex procedure (e.g. Firefox has the certificate manager buried deeply into the advanced options). While fine as a fallback method (e.g., for less common browsers) it is not very convenient.

Open PKCS#12 file with browser

jGridstart saves a PKCS#12 file and feeds it to the browser as a local file. This probably imports the data into the system certificate store on Windows, but Mozilla Firefox doesn't and handles it as an ordinary downloaded file. When served over HTTP instead of opening a local file with mimetype application/x-x509-user-cert, Firefox only imports the certificate if a private key is already present in its keystore (so it would only work with the KeyGen tag). [1] [2] [3]

pk12util

Mozilla Firefox (and other programs based on XULRunner) can query and modify the keystore using the command-line tool pk12util. This is installed by default on Linux but not Windows. When pk12util runs, the browser must be closed or the keystore is overwritten when it closes. The Windows keystore has a similar tool, iirc. [4]

Before running pk12util the browser must be closed. This can be tested by looking at the lock file (on Linux, at least, lock is present only when the Profile is running). An alternative to check if the 'default' Firefox profile is running is by using firefox -remote 'ping()', which will only fail if it's not running.

cryptext

Microsoft cryptography extensions for managing the system's certificate store. It can be accessed in several ways:

• using cryptext.dll, e.g. with rundll32 [5]
• using certmgr.exe, part of Windows SDK [6]
• using the CEnroll ActiveX object
• ... other?

XPCOM

The API of Mozilla programs can be accessed using XPCOM, also from Java. This requires finding the program installation directory and locating the jar. Of course then the ABI (32bit/64bit) of Java and Firefox must be equal, but it should be possible to update the keystore when the browser is running. Only applicable for Mozilla-based products, of course. [7] [8] It does not seem that JavaXPCOM is distributed with Firefox, so it would be quite a hassle to use it in practice.

certtool

certtool is a command-line tool (also shown here)

Related

• SensorNet Public/Private Key Certificate Infrastructure
• DOEgrid enrollment
• Key Manager Firefox extension that does most PKI stuff in a GUI