JGridstart/Browser certificate installation
Installing a certificate into a browser can be done in a lot of ways, some of which are cumbersome for the user, others are a lot of work to implement for the developer. jGridStart is a Java application, so the starting point is to install a client certificate and private key into browsers' keystores. Some approaches are discussed below.
| Mozilla/Firefox | Internet Explorer | Safari | ||
|---|---|---|---|---|
| manual import of PKCS#12 | V | V | V | cumbersome for user |
| open PKCS#12 in browser | V | ? | ||
| pk12util | V | ? | browser must be closed | |
| XPCOM | V |
Manual import of PKCS#12 file within browser
This is a method that always works: jGridStart exports a PKCS#12 file which the user imports from the browser. This can be a fairly complex procedure (e.g. Firefox has the certificate manager buried deeply into the advanced options). While fine as a fallback method (e.g., for less common browsers) it is not very convenient.
Open PKCS#12 file with browser
jGridstart saves a PKCS#12 file and feeds it to the browser as a local file. This probably imports the data into the system certificate store on Windows, but Mozilla Firefox doesn't and handles it as an ordinary downloaded file. When served over HTTP instead of opening a local file with mimetype application/x-x509-user-cert, Firefox only imports the certificate if a private key is already present in its keystore (so it would only work with the KeyGen tag). [1] [2] [3]
pk12util
Mozilla Firefox (and other programs based on XULRunner) can query and modify the keystore using the command-line tool pk12util. This is installed by default on Linux but not Windows. When pk12util runs, the browser must be closed or the keystore is overwritten when it closes. The Windows keystore has a similar tool, iirc. [4]
XPCOM
The API of Mozilla programs can be accessed using XPCOM, also from Java. This requires finding the program installation directory and locating the jar. Of course then the ABI (32bit/64bit) of Java and Firefox must be equal, but it should be possible to update the keystore when the browser is running. Only applicable for Mozilla-based products, of course. [5] [6] It does not seem that JavaXPCOM is distributed with Firefox, so it would be quite a hassle to use it in practice.
Related
- SensorNet Public/Private Key Certificate Infrastructure
- DOEgrid enrollment
- [Key Manager Firefox extension that does most PKI stuff in a GUI
