Globus-PKCS11

One of the pain points of using the grid is certificate management. At the DutchGrid Certificate Authority we have introduced jGridstart to make this a much more smooth experience. This has taken the approach to generate a Globus-type certificate first, and then import that into the browser.

Now that certificates can be obtained from an online service (no need to wait for three days anymore), the certificate is generated inside the browser. So another way to link the Globus- and browser-certificate is needed. (Note that it was attempted to integrate jGridstart into the online portal, but some security measures made this not as smooth as intended.)

A promising solution is to use a software PKCS#11 module in the browser that works on Globus-type certificates. A good start is to use soft-pkcs11 which operates on PEM files directly. The following issues still need to be faced:

• Use Globus-type certificates automatically (using environment/defaults) (done)
• Don't require loading at module load but in session (so external updates can happen)
• Add key-generation functionality so key/certificate can be generated from browser
• Address the question how to handle the old certificate when a new one is being generated
• Make sure it builds on other platforms
• Smooth installation on multiple platforms and web browsers

Unfortunately Windows doesn't support PKCS#11 but uses CryptoAPI instead. So for Internet Explorer and other applications using the Windows keystore, a similar but different program will be required.

Links

• PKCS11 at CAcert
• Firefox PKCS11
  • PKCS11 Module Installation on Firefox 3.5 and newer
  • Using Mozilla's security module database (including install script)
  • Using the JAR Installation Manager with NSS / Netscape
• Mac OS X and PKCS11
  • PKCS#11 and Mac OS X

Keychain Integration] and the software.

• Related work
  • Proxy certificate generation in the browser
  • SConnect: A Browser-Based Approach to Smart Card Connectivity
  • Belgium eID Firefox Extension (source), and a related javascript library
  • EsteID Estonian ID card software, including mozilla plugin for signing with javascript
  • OpenSC signer browser plugin (source)